#VU81859 Race condition in Microsoft products - CVE-2023-36565

Vulnerability identifier: #VU81859

Vulnerability risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-36565

CWE-ID: CWE-362

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Microsoft Office for Universal
Client/Desktop applications / Office applications
Microsoft Office for Android
Mobile applications / Apps for mobile phones
Microsoft Office LTSC
Client/Desktop applications / Other client software

Vendor: Microsoft

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in Microsoft Office Graphics. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Microsoft Office for Universal: before 16.0.14326.21606

Microsoft Office for Android: before 16.0.16827.20138

Microsoft Office LTSC: before 16.78 23100802

---

External links
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36565

---

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?