Use-after-free in Microsoft Office for macOS and Microsoft 365 Apps for Enterprise - CVE-2023-28285
Published: April 11, 2023 / Updated: October 25, 2024
Vulnerability identifier: #VU74968
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-28285
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when parsing SKP files. A remote attacker can trick the victim to open a specially crafted SKP file, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Affected software
Microsoft Office for macOS
Microsoft 365 Apps for Enterprise
Microsoft 365 Apps for Enterprise
How to mitigate CVE-2023-28285
Install updates from vendor's website.
Microsoft Office for macOS - update to 16.72 23040900
Microsoft 365 Apps for Enterprise - addressed in versions 16.0.14931.20964, 16.0.15601.20626, 16.0.16026.20274, 16.0.16130.20394, 16.0.16227.20280
Microsoft 365 Apps for Enterprise - addressed in versions 16.0.14931.20964, 16.0.15601.20626, 16.0.16026.20274, 16.0.16130.20394, 16.0.16227.20280