CVE-2023-36761: Microsoft Word Information Disclosure Flaw

CVE-2023-36761 Overview

CVE-2023-36761 is a Microsoft Word Information Disclosure Vulnerability that affects multiple versions of Microsoft Office products, including Microsoft 365 Apps, Microsoft Office 2019, Office LTSC 2021, and standalone Microsoft Word installations. This vulnerability allows attackers to disclose sensitive information through specially crafted documents, potentially exposing NTLM hashes when a malicious document is processed.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating its use in real-world attacks against organizations.

Affected Products

• Microsoft 365 Apps for Enterprise (x86 and x64)
• Microsoft Office 2019 (x86 and x64)
• Microsoft Office Long Term Servicing Channel 2021 (x86 and x64)
• Microsoft Word 2013 SP1 (x86, x64, and RT)
• Microsoft Word 2016 (x86 and x64)

Discovery Timeline

• September 12, 2023 - CVE-2023-36761 published to NVD
• October 28, 2025 - Last updated in NVD database

Technical Details for CVE-2023-36761

Vulnerability Analysis

This information disclosure vulnerability stems from improper input validation (CWE-20) in Microsoft Word's document processing functionality. When a user opens or previews a specially crafted Word document, the application may inadvertently disclose sensitive information, including NTLM hashes. The vulnerability can be triggered not only by opening a malicious document but also through the Preview Pane feature in Windows Explorer, making it particularly dangerous as user interaction requirements are minimal.

The attack requires network-based delivery of a malicious document to the target, but no privileges are needed by the attacker. User interaction is required in the form of opening or previewing the document. The primary impact is on confidentiality, with no direct effect on integrity or availability of the system.

Root Cause

The root cause of CVE-2023-36761 is improper input validation (CWE-20) within Microsoft Word's document parsing routines. When processing certain document elements, Word fails to properly validate external references or embedded content, allowing attackers to craft documents that trigger outbound connections. These connections can leak NTLM authentication hashes to attacker-controlled servers, enabling credential theft and potential relay attacks.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to deliver a malicious Word document to a target user. The attack can succeed through multiple vectors:

1. Email-based delivery: Sending malicious documents as attachments
2. Web-based delivery: Hosting documents on compromised or attacker-controlled websites
3. Preview exploitation: Simply previewing the document in Windows Explorer's Preview Pane can trigger the vulnerability without explicitly opening the file

Once the document is processed, it can force an outbound connection to an attacker-controlled server, capturing NTLM authentication hashes that can be used for offline cracking or pass-the-hash attacks.

Detection Methods for CVE-2023-36761

Indicators of Compromise

• Unexpected outbound SMB connections (port 445) from Microsoft Word processes to external IP addresses
• Unusual network traffic patterns from WINWORD.EXE to unknown or suspicious destinations
• NTLM authentication attempts to non-corporate servers or unfamiliar domains
• Suspicious Word document files with embedded external references or unusual OLE objects

Detection Strategies

• Monitor for outbound SMB traffic originating from Microsoft Office applications, particularly to external IP addresses
• Implement network-level detection for NTLM relay attack patterns and credential theft indicators
• Deploy endpoint detection rules to identify Word processes making unexpected network connections
• Analyze email attachments and downloaded files for suspicious document characteristics before user access

Monitoring Recommendations

• Enable detailed logging for Microsoft Office applications and correlate with network traffic data
• Configure SIEM rules to alert on WINWORD.EXE initiating connections to external IP addresses on SMB-related ports
• Monitor Windows Security Event logs for anomalous NTLM authentication events (Event IDs 4624, 4625, 4648)
• Implement file integrity monitoring on commonly targeted directories for suspicious document files

How to Mitigate CVE-2023-36761

Immediate Actions Required

• Apply the September 2023 Microsoft security updates immediately for all affected Office products
• Disable the Preview Pane in Windows Explorer to prevent exploitation via document preview
• Block outbound SMB traffic (port 445) at the network perimeter to prevent NTLM hash exfiltration
• Educate users about the risks of opening documents from untrusted sources

Patch Information

Microsoft has released security updates to address CVE-2023-36761 as part of the September 2023 Patch Tuesday release. Organizations should apply updates for all affected products including Microsoft 365 Apps, Office 2019, Office LTSC 2021, and standalone Word installations. Detailed patch information and download links are available through the Microsoft Security Update Guide.

Given that this vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog, federal agencies and critical infrastructure organizations should prioritize remediation according to CISA's binding operational directives.

Workarounds

• Disable the Windows Explorer Preview Pane and Details Pane to prevent preview-based exploitation
• Configure Windows Firewall to block outbound SMB connections from Office applications
• Implement Protected View settings in Microsoft Office to restrict document functionality from untrusted sources
• Consider deploying application control policies to restrict Office macro and external content execution

# Disable Preview Pane via Registry (Windows)
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoPreviewPane /t REG_DWORD /d 1 /f

# Block outbound SMB at Windows Firewall
netsh advfirewall firewall add rule name="Block Outbound SMB" dir=out action=block protocol=TCP remoteport=445