CVE-2024-43463: Microsoft Office Visio RCE Vulnerability

CVE-2024-43463 Overview

CVE-2024-43463 is a remote code execution vulnerability in Microsoft Office Visio caused by a use-after-free condition [CWE-416]. An attacker who successfully exploits this flaw can execute arbitrary code in the context of the current user. Exploitation requires the victim to open a specially crafted Visio file, so the attack vector is local and user interaction is required.

Microsoft published the advisory on September 10, 2024 as part of Patch Tuesday. The vulnerability affects multiple Office variants including Microsoft 365 Apps, Office 2019, Office LTSC 2021, and Visio 2016.

Critical Impact
A crafted Visio document can trigger arbitrary code execution under the logged-on user, enabling malware delivery, credential theft, and lateral movement from a single opened attachment.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019 (x86 and x64)
Microsoft Office LTSC 2021 (x86 and x64)
Microsoft Visio 2016

Discovery Timeline

2024-09-10 - CVE-2024-43463 published to the National Vulnerability Database
2024-09-10 - Microsoft releases security patch through the Microsoft CVE-2024-43463 Vulnerability Guide
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2024-43463

Vulnerability Analysis

The flaw resides in how Microsoft Office Visio parses crafted document content. When Visio processes the malicious file, it references memory that has already been freed, satisfying the conditions for a use-after-free [CWE-416]. Attackers can shape heap layout to control the freed object, then trigger reuse to redirect execution into attacker-controlled data.

Successful exploitation yields code execution in the security context of the user opening the file. On workstations where users operate with administrative rights, the attacker inherits full control of the machine. The vulnerability affects confidentiality, integrity, and availability.

Root Cause

The root cause is improper object lifetime management inside the Visio file parser. A pointer to a previously deallocated object is retained and later dereferenced during document processing. Attackers craft the input to force allocation of controlled data into the freed slot before the stale pointer is used.

Attack Vector

Exploitation requires a user to open a weaponized .vsdx, .vsd, or related Visio file. Delivery typically occurs through email attachments, phishing links to cloud storage, or compromised file shares. The attack does not traverse a network boundary independently; it depends on social engineering to induce the user to open the document.

No public proof-of-concept code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft CVE-2024-43463 Vulnerability Guide for vendor-provided technical detail.

Detection Methods for CVE-2024-43463

Indicators of Compromise

Unexpected child processes spawned by visio.exe or winword.exe, particularly cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Visio process making outbound network connections to previously unseen or low-reputation domains shortly after opening a document.
Newly written executable or script files under %APPDATA%, %TEMP%, or user profile directories following a Visio document open event.

Detection Strategies

Alert on Office application process trees that deviate from baseline behavior, especially Visio spawning interpreters or scripting engines.
Hunt for anomalous DLL loads inside visio.exe originating from user-writable paths.
Inspect email gateways and file shares for Visio file formats delivered from external senders, and detonate suspicious samples in a sandbox.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.
Collect and centralize Sysmon Event ID 1 (process creation) and Event ID 11 (file create) events for Office binaries.
Correlate endpoint telemetry with email metadata to identify which recipients opened Visio attachments from a given campaign.

How to Mitigate CVE-2024-43463

Immediate Actions Required

Apply the September 2024 Microsoft security updates for Microsoft 365 Apps, Office 2019, Office LTSC 2021, and Visio 2016 as documented in the Microsoft CVE-2024-43463 Vulnerability Guide.
Inventory endpoints running affected Visio and Office builds and prioritize patching for users who routinely handle external documents.
Reinforce user awareness training on unsolicited Visio attachments and cloud-share links.

Patch Information

Microsoft addressed the vulnerability in the September 10, 2024 security update cycle. Administrators should deploy the update channel-appropriate build for Microsoft 365 Apps and install the corresponding MSI or Click-to-Run patches for Office 2019, Office LTSC 2021, and Visio 2016. Verify installation through the vendor advisory linked above.

Workarounds

Block inbound Visio file formats (.vsd, .vsdx, .vsdm, .vsdx) at the email gateway when patching cannot be completed immediately.
Enforce Protected View for files originating from the internet and require explicit user action to enable editing.
Remove local administrator rights from standard users to limit the impact of code executed under the user context.

bash

# Enforce Protected View for Office files from the internet via registry
reg add "HKCU\Software\Microsoft\Office\16.0\Visio\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Visio\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Visio\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f