CVE-2024-20677
Microsoft
CVE-2024-20677 is a security vulnerability in the FBX component potentially allowing remote code execution. Microsoft has disabled FBX file insertion in Word, Excel, PowerPoint, and Outlook across Windows and Mac to address this critical risk. This impacts Office 2019, 2021, Office LTSC for Mac 2021, and Microsoft 365. While existing 3D models in Office from FBX files should continue to function, those linked externally may be affected. The vendor advisory highlights the prompt action taken by Microsoft to mitigate the exploit. Although the CVSS score is 7.8 (High), the SOCRadar Vulnerability Risk Score (SVRS) of 30 suggests a lower, but still present, level of immediate threat compared to vulnerabilities with SVRS scores exceeding 80. The core issue is a CWE-122, indicating a heap-based buffer overflow.
Description:
CVE-2024-20677 is a security vulnerability in FBX that could lead to remote code execution. Microsoft has disabled the ability to insert FBX files in Office applications for Windows and Mac to mitigate this vulnerability.
Key Insights:
-
Severity: The SVRS score of 34 indicates a moderate risk, suggesting that the vulnerability is not as critical as others with higher scores. However, it still requires attention and appropriate mitigation measures.
-
Affected Software: The vulnerability affects various Microsoft Office applications, including Word, Excel, PowerPoint, and Outlook, across different platforms (Windows and Mac).
-
Exploitation Status: There is no information available regarding active exploits or whether the vulnerability is being actively exploited in the wild.
-
CISA Warning: There is no information available regarding a warning issued by the Cybersecurity and Infrastructure Security Agency (CISA).
Mitigation Strategies:
-
Disable FBX File Insertion: Organizations should disable the ability to insert FBX files in Microsoft Office applications to prevent potential exploitation of this vulnerability.
-
Update Office Applications: Ensure that all Microsoft Office applications are updated to the latest version, which includes the fix for this vulnerability.
-
Educate Users: Educate users about the risks associated with opening untrusted or suspicious FBX files and advise them to exercise caution when handling such files.
-
Implement Strong Security Practices: Implement robust security practices, such as using strong passwords, enabling multi-factor authentication, and regularly backing up data, to minimize the impact of potential security breaches.
Additional Information:
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.