CVE-2024-30101: Microsoft 365 Apps RCE Vulnerability

CVE-2024-30101 Overview

CVE-2024-30101 is a remote code execution vulnerability in Microsoft Office caused by a use-after-free condition [CWE-416]. The flaw affects Microsoft 365 Apps and supported Office releases including Office 2016, 2019, and 2021 LTSC across x86 and x64 architectures. Exploitation requires the target user to open a crafted Office document or preview it in the Outlook Preview Pane. Successful exploitation lets attackers execute arbitrary code in the context of the current user.

Critical Impact

Attackers who convince a user to open a malicious Office file can run code with the user's privileges, enabling credential theft, persistence, and lateral movement.

Affected Products

• Microsoft 365 Apps for Enterprise (x86 and x64)
• Microsoft Office 2016 and Office 2019 (x86 and x64)
• Microsoft Office LTSC 2021 (x86 and x64)

Discovery Timeline

• 2024-06-11 - CVE-2024-30101 published to the National Vulnerability Database (NVD)
• 2024-06-11 - Microsoft released security update guidance via the Microsoft Security Update Guide
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-30101

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in Microsoft Office's document processing logic. Office frees an object during document parsing but retains a dangling reference that is later dereferenced. An attacker who controls allocation patterns through crafted document content can reclaim the freed memory with attacker-controlled data. Dereferencing the stale pointer can transfer execution flow to attacker-supplied code.

Exploitation is constrained by user interaction and attack complexity. The user must open or preview the crafted document, and the attacker must win a memory reuse race to achieve reliable code execution. When chained with reliable heap grooming, the flaw permits arbitrary code execution in the Office process context.

The Exploit Prediction Scoring System (EPSS) places this CVE in the upper range of likely-exploited issues, reflecting common attacker interest in Office file-format flaws.

Root Cause

The defect originates in object lifetime management inside Office's document parser. A code path releases a heap object while another reference remains live. Subsequent operations dereference the freed pointer, breaking memory-safety invariants and enabling control of program flow.

Attack Vector

Delivery is network-based but requires user interaction. Attackers typically distribute weaponized Office documents through phishing email, malicious links, or compromised file shares. Preview pane rendering in Outlook can trigger the vulnerable code path without an explicit document open action in some configurations.

No verified public proof-of-concept exists at the time of writing. Refer to the Microsoft Security Update Guide for vendor technical context.

Detection Methods for CVE-2024-30101

Indicators of Compromise

• Office processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, OUTLOOK.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, mshta.exe, or rundll32.exe.
• Office binaries writing executable files to %TEMP%, %APPDATA%, or %PUBLIC% directories.
• Outbound network connections initiated directly from Office processes to uncategorized or newly registered domains.
• Crash dumps or Windows Error Reporting events referencing Office modules with access violations on freed heap memory.

Detection Strategies

• Hunt for parent-child process anomalies where Office applications launch script interpreters or living-off-the-land binaries.
• Inspect inbound email attachments for Office documents containing embedded objects, unusual OLE streams, or RTF objects associated with use-after-free triggers.
• Correlate document open events with subsequent suspicious process creation, file writes, and network egress within short time windows.

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office from creating child processes and from injecting code into other processes.
• Forward Sysmon process creation, image load, and network connection events to a SIEM for retroactive hunting.
• Monitor Outlook Preview Pane interactions in high-risk roles and alert on Office crashes that may indicate exploitation attempts.

How to Mitigate CVE-2024-30101

Immediate Actions Required

• Apply the June 2024 Microsoft security updates for all affected Office and Microsoft 365 Apps installations referenced in the Microsoft Security Update Guide.
• Verify update deployment status across managed endpoints and prioritize systems exposed to external email.
• Block or sandbox inbound Office attachments from untrusted senders at the email gateway pending patch deployment.

Patch Information

Microsoft published security updates for Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, and Office LTSC 2021 on June 11, 2024. Patch availability and Knowledge Base article numbers per product are listed in the Microsoft Security Update Guide.

Workarounds

• Disable the Outlook Preview Pane to reduce passive exploitation exposure.
• Enforce Protected View and Office macro restrictions through Group Policy or Intune for documents sourced from email and the internet.
• Configure ASR rules to block Office applications from creating child processes and from creating executable content.

# Configuration example: enable ASR rule blocking Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled