5.5 Medium

CVE-2024-49065 Microsoft Office Remote Code Execution Vulnerability

Description

Microsoft Office Remote Code Execution Vulnerability

CVSS 3.1 detail

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Exploitable with local access to the machine, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Local
Attack complexity: Low
Privileges required: None
Interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
Microsoft SharePoint Enterprise Server 2016 16.0	16.0.0 → < 16.0.5478.1000	16.0.5478.1000
Microsoft SharePoint Server 2019 16.0	16.0.0 → < 16.0.10416.20026	16.0.10416.20026
Microsoft Office 2019 19.0	19.0.0 → latest	No fix stated
Microsoft 365 Apps for Enterprise 16.0	16.0.1 → latest	No fix stated
Microsoft Office LTSC for Mac 2021 16.0	16.0.1 → < 16.92.24120731	16.92.24120731
Microsoft Office LTSC 2021 16.0	16.0.1 → latest	No fix stated
Microsoft Office LTSC 2024 1.0	1.0.0 → latest	No fix stated
Microsoft Office LTSC for Mac 2024 1.0	1.0.0 → < 16.92.24120731	16.92.24120731
Microsoft Word 2016 16.0	16.0.1 → < 16.0.5478.1000	16.0.5478.1000