CVE-2024-38171 Overview
CVE-2024-38171 is a remote code execution vulnerability in Microsoft PowerPoint caused by a use-after-free condition [CWE-416]. An attacker who successfully exploits this flaw can execute arbitrary code in the context of the current user. Exploitation requires the target user to open a specially crafted PowerPoint file, satisfying the user interaction requirement in the CVSS vector.
The vulnerability affects multiple Microsoft Office products including Microsoft 365 Apps, Office 2019, Office LTSC 2021 (Windows and macOS), and PowerPoint 2016. Microsoft published the advisory on August 13, 2024 as part of its monthly security update cycle.
Critical Impact
Successful exploitation grants an attacker code execution with the privileges of the logged-on user, enabling data theft, persistence, and lateral movement inside Office document workflows.
Affected Products
- Microsoft 365 Apps
- Microsoft Office 2019 and Office LTSC 2021 (Windows and macOS)
- Microsoft PowerPoint 2016
Discovery Timeline
- 2024-08-13 - CVE-2024-38171 published to NVD and addressed in Microsoft's August 2024 security update
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-38171
Vulnerability Analysis
The vulnerability is a use-after-free condition [CWE-416] in Microsoft PowerPoint. Use-after-free flaws arise when a program continues to reference memory after it has been released, allowing an attacker to reuse that region to control program flow. In PowerPoint, the freed object can be reclaimed with attacker-controlled data through crafted presentation content.
When the application later dereferences the stale pointer, it operates on the attacker's data. This behavior enables arbitrary code execution in the process context of the PowerPoint user. The CVSS vector indicates a local attack vector with low complexity, no privileges required, and user interaction to open the malicious file.
Root Cause
The root cause is improper object lifetime management within PowerPoint's document parsing or rendering paths. A crafted .pptx or related file triggers premature release of an internal object while a reference to it remains reachable. Subsequent access to that reference operates on freed memory, corrupting program state.
Attack Vector
An attacker delivers a weaponized PowerPoint document through phishing email, a compromised web download, or a shared file location. The victim opens the file with a vulnerable PowerPoint build, triggering the use-after-free during parsing or rendering. Code executes in the user's security context without requiring privilege escalation prior to execution.
No public exploit or proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Vulnerability Advisory CVE-2024-38171 for vendor guidance.
Detection Methods for CVE-2024-38171
Indicators of Compromise
- PowerPoint documents received from untrusted external senders that spawn child processes such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
- Unexpected outbound network connections initiated by POWERPNT.EXE shortly after a document is opened.
- New files written to %TEMP%, %APPDATA%, or Office startup folders following the opening of an untrusted .pptx file.
Detection Strategies
- Alert on process lineage where POWERPNT.EXE is the parent of scripting or LOLBin processes, which is atypical for benign presentations.
- Monitor Office telemetry for crash events or exception codes tied to memory access violations that may indicate exploitation attempts.
- Inspect email attachments and file uploads with sandbox detonation to observe use-after-free crash signatures or shellcode execution.
Monitoring Recommendations
- Ingest Microsoft Defender and Office alerts into a centralized SIEM and correlate with endpoint process telemetry.
- Track Office application versions across the fleet to identify hosts still running unpatched builds.
- Retain endpoint telemetry for at least 90 days to support retrospective hunts once new indicators emerge.
How to Mitigate CVE-2024-38171
Immediate Actions Required
- Apply Microsoft's August 2024 security updates for Microsoft 365 Apps, Office 2019, Office LTSC 2021, and PowerPoint 2016 across all endpoints.
- Prioritize patching for users who routinely receive external documents, including finance, HR, and executive assistants.
- Verify update deployment status through configuration management or vulnerability scanning to confirm no vulnerable builds remain.
Patch Information
Microsoft addressed CVE-2024-38171 in the August 13, 2024 security release. Update details and download links are provided in the Microsoft Vulnerability Advisory CVE-2024-38171. Administrators should deploy the fix through Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Intune.
Workarounds
- Enable Protected View for files originating from the internet and other untrusted locations to reduce parsing exposure.
- Block or quarantine PowerPoint attachments from external senders at the email gateway pending patch rollout.
- Enforce Attack Surface Reduction (ASR) rules that prevent Office applications from creating child processes.
# Configuration example: enable ASR rule blocking Office child process creation
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
-AttackSurfaceReductionRules_Actions Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
