CVE-2024-30040

FAQ

What kind of security feature could be bypassed by successfully exploiting this vulnerability?

This vulnerability bypasses OLE mitigations in Microsoft 365 and Microsoft Office which protect users from vulnerable COM/OLE controls.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

An attacker would have to convince the user to load a malicious file onto a vulnerable system, typically by way of an enticement in an Email or Instant Messenger message, and then convince the user to manipulate the specially crafted file, but not necessarily click or open the malicious file.

How could an attacker exploit this vulnerability?

An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through convincing a user to open a malicious document at which point the attacker could execute arbitrary code in the context of the user.