Main Vulnerability Database Vulnerabilities #VU94003

Input validation error in Microsoft products - CVE-2024-38021

Published: July 9, 2024

Vulnerability identifier: #VU94003

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-38021

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft Office. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Affected software

Microsoft Office LTSC
Microsoft 365 Apps for Enterprise
Microsoft Office

How to mitigate CVE-2024-38021

Install updates from vendor's website.

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38021

Related Security Bulletins