Jonggeon Kim

**Name of the Vulnerable Software and Affected Versions** Microsoft Outlook versions 2016 Microsoft Office versions 2019 through 2024 **Description** The issue allows remote attackers to execute arbitrary code and affect the system. It is reported that this issue has been patched by Microsoft with the aid of external researchers. **Recommendations** For Microsoft Outlook version 2016, apply the patch provided by Microsoft. For Microsoft Office versions 2019 through 2024, apply the patch provided by Microsoft. As a temporary workaround, consider restricting access to potentially vulnerable components until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office versions prior to the fixed version Microsoft 365 Apps for Enterprise versions prior to the fixed version **Description** The issue is related to the use of an unreliable path search in Microsoft Office and Microsoft 365 Apps for Enterprise. This allows an attacker to execute arbitrary code. The vulnerability affects Word, PowerPoint, and Outlook. It is described as a logic bug that includes built-in process control and built-in PV bypass. **Recommendations** For Microsoft Office versions prior to the fixed version, update to the fixed version to resolve the issue. For Microsoft 365 Apps for Enterprise versions prior to the fixed version, update to the fixed version to resolve the issue. As a temporary workaround, consider restricting the use of built-in processes and PV until a patch is available.