CVE-2023-21741 Overview
CVE-2023-21741 is an information disclosure vulnerability affecting Microsoft Office Visio and related Microsoft Office products. The flaw stems from an out-of-bounds read condition [CWE-125] in the parsing logic for Visio file formats. An authenticated attacker can exploit the vulnerability by crafting a malicious Visio document and convincing a user to open it. Successful exploitation can disclose sensitive memory contents from the affected process to the attacker.
Microsoft assigned this vulnerability a CVSS 3.1 base score of 7.1 and rated it HIGH severity. The EPSS score is 6.444% with a percentile of 91.16, indicating elevated likelihood of exploitation compared to most published CVEs.
Critical Impact
Successful exploitation discloses sensitive process memory contents from Microsoft Office and Visio, potentially exposing data that supports follow-on attacks.
Affected Products
- Microsoft 365 Apps (Enterprise)
- Microsoft Office 2019
- Microsoft Office LTSC 2021
- Microsoft Visio 2013 SP1 and Microsoft Visio 2016
Discovery Timeline
- 2023-01-10 - CVE-2023-21741 published to the National Vulnerability Database (NVD)
- 2023-01-10 - Microsoft released security update guidance for CVE-2023-21741
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-21741
Vulnerability Analysis
The vulnerability is an information disclosure issue in Microsoft Office Visio. It is categorized under [CWE-125] Out-of-Bounds Read, indicating the affected component reads memory beyond the bounds of an allocated buffer when processing a Visio file. The read content can contain residual data from the process address space, including pointers, fragments of documents, or other in-memory artifacts useful to an attacker.
The attack vector is Network according to the CVSS metrics, reflecting Microsoft's modeling of file-based Office attacks delivered through links or remote shares. The attacker requires low privileges and no user interaction beyond standard Office workflow. The scope is unchanged, and only confidentiality is rated High, with availability rated Low.
Root Cause
The root cause is improper validation of length or offset fields inside a Visio file structure. When Visio parses a malformed object, it reads past the intended buffer boundary. The leaked bytes are then incorporated into the rendered document or returned through file processing logic, allowing the attacker to recover memory contents.
Attack Vector
An attacker crafts a malicious Visio file (.vsd, .vsdx, or related extension) and delivers it through email, a SharePoint link, a network share, or a download. When a victim with an affected Office or Visio version opens the file, the parsing path triggers the out-of-bounds read. The disclosed memory can be exfiltrated by embedded content references, telemetry, or by inducing the user to share the rendered document.
No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose based on Microsoft's advisory and the assigned CWE classification. See the Microsoft Security Update Guide for CVE-2023-21741 for vendor technical details.
Detection Methods for CVE-2023-21741
Indicators of Compromise
- Unexpected .vsd, .vsdx, .vsdm, or .vstx files originating from external email senders or untrusted shares.
- Office or Visio processes (visio.exe, winword.exe) generating outbound network connections shortly after opening a document.
- Crash dumps or Windows Error Reporting entries referencing Visio file parsing modules.
Detection Strategies
- Inspect email gateways and content filters for inbound Visio attachments and quarantine those from untrusted senders.
- Hunt for Visio file opens followed by anomalous child processes, scripting hosts, or outbound traffic to uncategorized domains.
- Correlate Office telemetry with EDR process events to surface unusual memory access patterns within Visio.
Monitoring Recommendations
- Enable Microsoft Defender for Office 365 Safe Attachments and Safe Links scanning on all Visio file types.
- Audit endpoint inventories for unpatched Office 2019, Office LTSC 2021, Microsoft 365 Apps, Visio 2013 SP1, and Visio 2016 installations.
- Forward Office application logs and EDR telemetry to a centralized SIEM for retention and retroactive hunting.
How to Mitigate CVE-2023-21741
Immediate Actions Required
- Apply the January 2023 Microsoft security updates that address CVE-2023-21741 to all affected Office and Visio installations.
- Identify endpoints that opened untrusted Visio files between the publication date and patch deployment and review them for follow-on activity.
- Restrict Visio file delivery from external senders at the mail gateway until patching is verified.
Patch Information
Microsoft published the patch through the January 2023 Patch Tuesday cycle. Refer to the Microsoft Security Update Guide for CVE-2023-21741 for the specific KB articles and build numbers that correspond to each affected SKU. Microsoft 365 Apps customers should confirm that automatic updates installed the fixed channel build.
Workarounds
- Open untrusted Visio files only in Protected View, which isolates parsing in a sandboxed process.
- Block or strip Visio file extensions at the email gateway when business workflows do not require them.
- Apply Attack Surface Reduction rules that block Office applications from creating child processes and from making outbound network calls.
# Verify Visio and Office build numbers on Windows endpoints
reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v VersionToReport
# Force Microsoft 365 Apps to update to the patched channel build
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
