Out-of-bounds write in Microsoft products - CVE-2023-28311
Published: April 11, 2023 / Updated: October 25, 2024
Vulnerability identifier: #VU74937
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-28311
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in Microsoft Office Word. A remote attacker can create a specially crafted DOCX file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.
Affected software
Microsoft Office for macOS
Microsoft 365 Apps for Enterprise
Microsoft Word
Microsoft 365 Apps for Enterprise
Microsoft Word
How to mitigate CVE-2023-28311
Install updates from vendor's website.
Microsoft Office for macOS - update to 16.72 23040900
Microsoft 365 Apps for Enterprise - addressed in versions 16.0.14931.20964, 16.0.15601.20626, 16.0.16026.20274, 16.0.16130.20394, 16.0.16227.20280
Microsoft Word - addressed in versions 16.0.10397.20021, 16.0.16227.20280
Microsoft 365 Apps for Enterprise - addressed in versions 16.0.14931.20964, 16.0.15601.20626, 16.0.16026.20274, 16.0.16130.20394, 16.0.16227.20280
Microsoft Word - addressed in versions 16.0.10397.20021, 16.0.16227.20280