Ben Faull

Name of the Vulnerable Software and Affected Versions: Microsoft Office (affected versions not specified) Description: The issue concerns the deserialization of untrusted data in Microsoft Office, which allows an unauthorized attacker to elevate privileges locally. This means an attacker can gain higher access levels on the system, potentially leading to further malicious activities. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified) Description: The issue is related to improper input validation in Windows Security Zone Mapping, which allows an unauthorized attacker to bypass a security feature locally. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a security feature bypass vulnerability in the Windows Security Zone Mapping component. This vulnerability is caused by incorrect path equivalence permissions. Exploitation of this issue may allow an attacker to bypass existing security restrictions. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows MSHTML Platform (affected versions not specified) **Description** The issue is related to errors in security settings, allowing a remote attacker to bypass security restrictions. This can affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) Microsoft 365 Apps for Enterprise (affected versions not specified) **Description** The issue is related to a security feature bypass in Microsoft Office, which can be exploited by a remote attacker to bypass security restrictions and elevate privileges. This can affect the system. **Recommendations** For Microsoft Office, consider restricting access to sensitive features until a patch is available. For Microsoft 365 Apps for Enterprise, avoid using vulnerable authentication mechanisms until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Word (affected versions not specified) Microsoft SharePoint Server (affected versions not specified) Office 365 ProPlus (affected versions not specified) Microsoft Office (affected versions not specified) **Description** A remote code execution issue exists in Microsoft Word software when it fails to properly handle objects in Protected View. This could allow an attacker to run arbitrary code in the context of the current user. If the current user has administrative user rights, an attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Exploitation requires a user to open a specially crafted file with an affected version of Microsoft Office Word software. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Excel (affected versions not specified) Office 365 ProPlus (affected versions not specified) Microsoft Office (affected versions not specified) **Description** A remote code execution issue exists in Microsoft Excel software due to its failure to properly handle objects in Protected View. This could allow an attacker to run arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view, change, or delete data, or create new accounts with full user rights. The exploitation requires a user to open a specially crafted file with an affected version of Microsoft Office Excel software. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office versions (affected versions not specified) Microsoft PowerPoint versions (affected versions not specified) Office 365 ProPlus versions (affected versions not specified) PowerPoint Viewer versions (affected versions not specified) **Description** A remote code execution issue exists in Microsoft PowerPoint software due to its failure to properly handle objects in Protected View. This could allow an attacker to run arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view, change, or delete data, or create new accounts with full user rights. The exploitation of this issue requires a user to open a specially crafted file with an affected version of Microsoft Office PowerPoint software. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office 2007 SP2 Microsoft Office Word Viewer Microsoft Office 2010 SP2 Microsoft Office 2013 SP1 and RT SP1 Microsoft Office 2016 Microsoft Office 2016 Click-to-Run (C2R) **Description** A remote code execution issue exists due to how Office handles objects in memory. This allows an attacker to run arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view, change or delete data, or create new accounts. The exploitation requires a user to open a specially crafted file with an affected version of Microsoft Office software. **Recommendations** For Microsoft Office 2007 SP2, update to a newer version to mitigate the risk. For Microsoft Office Word Viewer, update to a newer version to mitigate the risk. For Microsoft Office 2010 SP2, update to a newer version to mitigate the risk. For Microsoft Office 2013 SP1 and RT SP1, update to a newer version to mitigate the risk. For Microsoft Office 2016, update to a newer version to mitigate the risk. For Microsoft Office 2016 Click-to-Run (C2R), update to a newer version to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office versions 2010 through 2016 **Description** The issue is related to the improper handling of objects in memory, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted file. Successful exploitation could allow an attacker to run code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view, change, or delete data, or create new accounts with full user rights. The impact may be less severe for users with limited rights. Exploitation requires a user to open a specially crafted file with an affected version of Microsoft Office. **Recommendations** For Microsoft Office 2010, update to a version that includes the fix for this issue. For Microsoft Office 2013, update to a version that includes the fix for this issue. For Microsoft Office 2016, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of specially crafted files with affected versions of Microsoft Office until a patch is available.