CVE-2024-38169: Microsoft 365 Apps RCE Vulnerability

CVE-2024-38169 Overview

CVE-2024-38169 is a remote code execution vulnerability affecting Microsoft Office Visio. The flaw stems from a heap-based buffer overflow [CWE-122] that attackers can trigger when a user opens a specially crafted Visio document. Successful exploitation allows arbitrary code execution in the context of the current user.

Microsoft classifies the flaw as a local attack vector requiring user interaction. Despite the local vector, delivery through phishing email attachments or malicious document downloads makes this a practical initial access vector for threat actors targeting enterprise environments.

Critical Impact
An attacker who convinces a user to open a crafted Visio file can execute code with the victim's privileges, leading to full compromise of confidentiality, integrity, and availability on the affected system.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Office 2019
Microsoft Office Long Term Servicing Channel 2021

Discovery Timeline

2024-08-13 - CVE-2024-38169 published to NVD and Microsoft releases security patch
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38169

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in the Microsoft Office Visio document parsing logic. When Visio processes malformed structures in a crafted file, the code writes past the bounds of an allocated heap buffer. The overflow corrupts adjacent heap metadata and object pointers.

An attacker who controls the overflow content can steer program execution to attacker-supplied shellcode or to Return-Oriented Programming (ROP) gadgets. The resulting code runs with the privileges of the user opening the file. On workstations where users hold local administrator rights, the impact extends to full host compromise.

The exploit prediction score (EPSS) currently sits at 0.827%, indicating moderate probability of exploitation activity relative to other CVEs. No public proof-of-concept exploit is currently documented, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is insufficient bounds validation during parsing of crafted Visio document structures. The parser trusts size or offset fields inside the file without validating them against the allocated buffer, allowing controlled writes beyond the heap chunk boundary.

Attack Vector

Exploitation requires an authenticated local user to open a malicious .vsd, .vsdx, or related Visio file. Attackers typically deliver such files through spear-phishing emails, malicious links, or compromised file-sharing services. Protected View provides some defensive friction, but users who click "Enable Editing" bypass this safeguard.

The vulnerability is exploitable without elevated privileges before the attack, but the attacker gains only the privilege level of the victim account. Chaining with a local privilege escalation is required to obtain SYSTEM-level control.

Detection Methods for CVE-2024-38169

Indicators of Compromise

Unexpected Visio files (.vsd, .vsdx, .vsdm) delivered as email attachments from external senders or downloaded from untrusted URLs.
visio.exe spawning unusual child processes such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
Outbound network connections initiated by visio.exe to previously unseen domains or IP addresses shortly after document opening.
Suspicious file writes by visio.exe into user-writable persistence locations such as %APPDATA%, %TEMP%, or Startup folders.

Detection Strategies

Deploy behavioral endpoint detection rules that alert on Office application processes spawning script interpreters or LOLBins.
Correlate Visio process creation events with subsequent network connections and file-write activity to surface exploitation chains.
Hunt for Visio documents containing embedded OLE objects, shellcode markers, or heavily obfuscated XML shape definitions.

Monitoring Recommendations

Ingest Sysmon Event IDs 1 (process create), 3 (network connect), and 11 (file create) from endpoints running Office into a centralized SIEM.
Enable Microsoft Defender attack surface reduction (ASR) rule audit logs that block Office child process creation.
Track patch compliance across all Microsoft 365 Apps, Office 2019, and Office LTSC 2021 endpoints to identify unpatched systems at risk.

How to Mitigate CVE-2024-38169

Immediate Actions Required

Apply the August 2024 Microsoft security updates addressing CVE-2024-38169 to all systems running Microsoft 365 Apps, Office 2019, or Office LTSC 2021.
Enforce Protected View and Office file-block policies for documents originating from the internet or email attachments.
Restrict local administrator rights on user workstations to limit the blast radius of any successful exploitation.

Patch Information

Microsoft released security updates on August 13, 2024, addressing this vulnerability. Refer to the Microsoft Security Update CVE-2024-38169 advisory for build numbers, click-to-run channels, and MSI package identifiers applicable to each affected product edition.

Workarounds

Enable Microsoft Defender ASR rules that block Office applications from creating child processes and from injecting code into other processes.
Configure Group Policy to open Visio files from the internet zone in Protected View and disable macro execution for files from untrusted locations.
Block inbound email attachments with Visio file extensions at the mail gateway for users who do not have a business need to receive them.

bash

# Configuration example: enable ASR rule to block Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled