Microsoft discloses Office zero-day, still working on a patch

Microsoft has disclosed a high-severity zero-day vulnerability affecting Office 2016 and later, which is still waiting for a patch.

Tracked as CVE-2024-38200, this security flaw is caused by an information disclosure weakness that enables unauthorized actors to access protected information such as system status or configuration data, personal info, or connection metadata.

The zero-day impacts multiple 32-bit and 64-bit Office versions, including Office 2016, Office 2019, Office LTSC 2021, and Microsoft 365 Apps for Enterprise.

Even though Microsoft's exploitability assessment says that exploitation of CVE-2024-38200 is less likely, MITRE has tagged the likelihood of exploitation for this type of weakness as highly probable.

"In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability," Microosoft's advisory explains.

"However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file."

The company is developing security updates to address this zero-day bug but has yet to announce a release date.

More details to be shared at Defcon

While Redmond has not shared any details regarding the flaw, its discovery was attributed to PrivSec Consulting security consultant Jim Rush and Synack Red Team member Metin Yunus Kandemir.

PrivSec's Managing Director Peter Jakowetz told BleepingComputer that Rush will disclose more information about this vulnerability in his upcoming "NTLM - The last ride" Defcon talk.

"There will be a deep dive on several new bugs we disclosed to Microsoft (including bypassing a fix to an existing CVE), some interesting and useful techniques, combining techniques from multiple bug classes resulting in some unexpected discoveries and some absolutely cooked bugs," Rush explains.

"We'll also uncover some defaults that simply shouldn't exist in sensible libraries or applications as well as some glaring gaps in some of the Microsoft NTLM related security controls."

A Synack spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today for more details regarding the CVE-2024-38200 vulnerability.

Microsoft is also working on patching zero-day flaws that could be exploited to "unpatch" up-to-date Windows systems and reintroduce old vulnerabilities.

The company also said earlier this week that it's considering patching a Windows Smart App Control, SmartScreen bypass exploited since 2018.