Ying Xinlei

Name of the Vulnerable Software and Affected Versions: Microsoft Office (affected versions not specified) Description: A remote code execution issue exists in Microsoft Office software due to improper handling of objects in memory. An attacker who successfully exploits this issue could run arbitrary code in the context of the current user. If the current user has administrative user rights, an attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Exploitation requires a user to open a specially crafted file with an affected version of Microsoft Office. This could occur through email or web-based attacks, where an attacker convinces a user to open the specially crafted file. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Graphics Device Interface Plus (GDI+) (affected versions not specified) Description: An information disclosure issue exists in the way GDI+ handles objects in memory, allowing an attacker to retrieve information from a targeted system. This issue does not allow arbitrary code execution on its own but could enable it if combined with another vulnerability. To exploit this, an attacker must log on to the system and run a specially crafted application. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Graphics Component (affected versions not specified) **Description** The issue is related to the improper handling of objects in memory by the Microsoft Windows Graphics Component, which can lead to information disclosure. This could allow an attacker to obtain sensitive information. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Excel (affected versions not specified) Microsoft Office (affected versions not specified) Office 365 (affected versions not specified) **Description** The issue is related to errors in handling objects in memory. Exploitation of this issue could allow an attacker to run arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view or modify data, or create new accounts with full rights. Users with limited rights may be less affected. Exploitation requires a user to open a specially crafted file with a vulnerable version of Microsoft Excel. **Recommendations** For Microsoft Excel, consider restricting the use of the software until a fix is available. For Microsoft Office, avoid opening suspicious files until the issue is resolved. For Office 365, restrict access to potentially vulnerable components until a patch is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Excel (affected versions not specified) **Description** An information disclosure issue exists due to Microsoft Excel's improper handling of memory contents. This could allow an attacker to disclose protected information using a specially crafted file. The exploitation of this issue may enable an attacker to compromise a user's computer or data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) Microsoft Excel (affected versions not specified) Microsoft Excel Viewer (affected versions not specified) **Description** The issue is related to errors in processing objects in memory, which can lead to the disclosure of protected information through a specially crafted document. An attacker who exploits this issue could use the disclosed information to compromise the user's computer or data. To exploit the issue, an attacker would need to craft a special document file and convince the user to open it, requiring knowledge of the memory address location where the object was created. **Recommendations** For Microsoft Office, update to a version that includes the fix for this issue. For Microsoft Excel, consider avoiding the use of specially crafted document files until a patch is available. For Microsoft Excel Viewer, restrict access to potentially vulnerable documents to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) Microsoft Excel (affected versions not specified) Microsoft Excel Viewer (affected versions not specified) **Description** The issue is related to incorrect handling of objects in memory, which can allow an attacker to execute arbitrary code with the privileges of the current user. If the user has administrative rights, the attacker could gain control over the system, enabling them to install programs, view, change, or delete data, and create new accounts with full user rights. Users with limited system rights are less exposed to this issue compared to those operating with administrative rights. **Recommendations** For Microsoft Office, update to a version that properly handles objects in memory to prevent exploitation. For Microsoft Excel, consider disabling features that handle objects in memory until a patch is available. For Microsoft Excel Viewer, restrict access to files that could be used to exploit the vulnerability until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Excel (affected versions not specified) **Description** A remote code execution issue exists due to the software's failure to properly handle objects in memory. This could allow an attacker to run arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with limited user rights may be less impacted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) **Description** The issue is caused by an out-of-bounds memory operation in Microsoft Office software. This can be exploited by a remote attacker using a specially crafted docx file, allowing them to execute arbitrary code. If the attacker successfully exploits the vulnerability, they could run code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view, change or delete data, or create new accounts with full user rights. The impact may be less severe for users with limited rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) **Description** The issue is caused by a buffer overflow in memory, allowing a remote attacker to execute arbitrary code using a specially crafted RTF file. Successful exploitation could enable an attacker to run arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view, change or delete data, or create new accounts with full user rights. The impact may be less severe for users with limited rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.