CVE-2022-38010: Microsoft Office Visio RCE Vulnerability

CVE-2022-38010 Overview

CVE-2022-38010 is a remote code execution vulnerability affecting Microsoft Office Visio and related Microsoft Office products. Despite the "remote code execution" label, the CVSS vector identifies a local attack vector requiring user interaction, typically through opening a crafted Visio file. Successful exploitation allows an attacker to execute arbitrary code in the context of the current user, compromising confidentiality, integrity, and availability of the host. Microsoft addressed the issue in the September 2022 Patch Tuesday release.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the victim user after opening a malicious Visio document, potentially leading to full system compromise when the user holds administrative privileges.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019 (x86 and x64)
Microsoft Office Long Term Servicing Channel 2021 (x86 and x64)
Microsoft Visio 2013 SP1 and Microsoft Visio 2016

Discovery Timeline

2022-09-13 - CVE-2022-38010 published to NVD
2022-09-13 - Microsoft releases security update via MSRC
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-38010

Vulnerability Analysis

CVE-2022-38010 is a client-side code execution flaw in Microsoft Office Visio file parsing. The vulnerability is triggered when a user opens a specially crafted Visio document, such as a .vsd, .vsdx, or related Visio file format. Microsoft classifies the issue as remote code execution, while the CVSS metrics indicate a local attack vector with required user interaction.

The vulnerability impacts the desktop Office stack, which means it reaches enterprise endpoints running Microsoft 365 Apps, Office 2019, Office LTSC 2021, Visio 2013 SP1, and Visio 2016. Microsoft has not published detailed root cause information for this issue, and the CWE classification remains NVD-CWE-noinfo.

EPSS data places the exploitation likelihood at 1.611% with a percentile near the 82nd, indicating attacker interest is non-trivial relative to other CVEs even though no public proof of concept or in-the-wild exploitation has been documented. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

Microsoft has not disclosed the underlying code defect. Vulnerabilities in this family typically stem from improper validation of structured records inside Visio file containers, leading to memory corruption during document parsing.

Attack Vector

An attacker crafts a malicious Visio document and delivers it through phishing email, a shared drive, or a web download. When the victim opens the file in a vulnerable Office or Visio client, the parser processes attacker-controlled data and executes embedded code with the user's privileges. No network privileges or prior authentication on the target system are required.

No verified proof-of-concept code is publicly available for CVE-2022-38010. Refer to the Microsoft Security Update CVE-2022-38010 advisory for vendor-supplied details.

Detection Methods for CVE-2022-38010

Indicators of Compromise

Unexpected child processes spawned by visio.exe, winword.exe, or excel.exe, particularly cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Visio documents (.vsd, .vsdx, .vsdm) arriving via email from untrusted senders or downloaded from suspicious URLs.
Outbound network connections initiated by Office processes to unfamiliar domains immediately after opening a document.
New persistence artifacts under HKCU\Software\Microsoft\Windows\CurrentVersion\Run created shortly after Office activity.

Detection Strategies

Hunt for process lineage where Office or Visio binaries spawn scripting engines, LOLBins, or unsigned binaries.
Inspect mail gateway logs for inbound messages carrying Visio attachments, especially those with macro-enabled extensions.
Correlate Office document open events with subsequent file writes to %TEMP%, %APPDATA%, or %PUBLIC% directories.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes.
Forward Sysmon process creation, image load, and network connection telemetry to a centralized analytics platform.
Track Office version and patch state across the fleet to identify endpoints still exposed to CVE-2022-38010.

How to Mitigate CVE-2022-38010

Immediate Actions Required

Apply the September 2022 Microsoft security updates referenced in the MSRC advisory for CVE-2022-38010 to all affected Office and Visio installations.
Prioritize patching for endpoints used by high-privilege users, executives, and developers who handle external documents.
Validate that Microsoft 365 Apps update channels are current and have successfully installed the cumulative fixes.

Patch Information

Microsoft released remediation for CVE-2022-38010 on 13 September 2022 as part of Patch Tuesday. Updates are delivered through Windows Update, Microsoft Update, and the Microsoft 365 Apps update channel. Administrators should consult the MSRC update guide entry for build numbers corresponding to each affected SKU, including Microsoft 365 Apps, Office 2019, Office LTSC 2021, Visio 2013 SP1, and Visio 2016.

Workarounds

Block inbound Visio file types at the email gateway when business processes do not require them.
Open untrusted Visio documents in Protected View and disable automatic content activation through Group Policy.
Restrict Office child-process creation using Attack Surface Reduction rules until patching is complete.

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled