Rick Cole

The issue is a security feature bypass vulnerability in Microsoft Office Publisher. It has been found exploited in the wild, affecting Microsoft products. There is no information provided about the estimated number of potentially affected devices worldwide or specific technical details about exploitation, such as API endpoints, vulnerable parameters, or function names.

The issue is related to a spoofing vulnerability in the AppX installer that affects Microsoft Windows. This vulnerability can be exploited by attackers using specially crafted packages that include malware, such as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns, and users with administrative user rights are more impacted than those with fewer user rights. Microsoft has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme. The estimated number of potentially affected devices worldwide is not specified.

Remote code execution is possible in MSHTML, the browser rendering engine used by Microsoft Internet Explorer and hosted within Microsoft Office documents. The issue stems from incorrect code generation management. An attacker can exploit this by crafting a malicious ActiveX control and embedding it into a Microsoft Office document. If a user is convinced to open the document, the attacker can execute arbitrary code on the system. Users with administrative rights are more severely impacted than those with restricted user rights. Real-world exploitation has been observed in targeted attacks by state-sponsored groups, such as APT 35, and has been used to deploy the MerkSpy spyware to monitor activities and capture sensitive information.