CVE-2024-43504: Microsoft Excel RCE Vulnerability

CVE-2024-43504 Overview

CVE-2024-43504 is a remote code execution vulnerability in Microsoft Excel caused by a use-after-free condition [CWE-416]. An attacker can craft a malicious Excel document that, when opened by a user, executes arbitrary code in the context of the current user. Microsoft published the advisory on October 8, 2024 as part of its Patch Tuesday release. The flaw affects Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021 and 2024 on both x64 and x86 platforms. Exploitation requires user interaction but no privileges, and successful attacks compromise confidentiality, integrity, and availability of the host.

Critical Impact
Attackers can execute arbitrary code on target systems by convincing users to open a crafted Excel file, leading to full user-context compromise.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016 (x64 and x86)
Microsoft Office 2019 and Office LTSC 2021/2024 (x64 and x86)

Discovery Timeline

2024-10-08 - CVE-2024-43504 published to NVD
2024-10-08 - Microsoft releases security update via Microsoft Security Update CVE-2024-43504
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43504

Vulnerability Analysis

CVE-2024-43504 is a use-after-free (UAF) memory corruption flaw within Microsoft Excel's document parsing logic. The vulnerability arises when Excel accesses a memory object after it has been freed, allowing an attacker to influence the contents of that freed memory region. When Excel later dereferences a pointer to the reclaimed object, execution can be redirected to attacker-controlled data. This class of flaw commonly enables arbitrary code execution when combined with heap grooming techniques and control-flow hijack primitives.

Exploitation requires a user to open a specially crafted Excel workbook. Code executes under the privileges of the logged-in user. On systems where users operate with administrative rights, the entire host is exposed to compromise. The EPSS score of 6.4% places this vulnerability in the 93rd percentile, indicating meaningful attacker interest compared to typical CVEs.

Root Cause

The root cause is improper object lifetime management within Excel's file parsing routines. A code path frees an internal object while another reference to that object remains reachable. Subsequent operations dereference the stale pointer, treating attacker-controlled bytes as valid object state, including virtual function tables.

Attack Vector

Delivery typically occurs through phishing emails containing malicious .xlsx, .xls, or .xlsm attachments, or through links to weaponized documents hosted on attacker-controlled infrastructure. The Preview Pane is not a vector; the user must open the document. Once opened, the crafted content triggers the UAF and executes the embedded shellcode or downloader.

No public proof-of-concept exploit is currently available. See the Microsoft Security Update CVE-2024-43504 for vendor-provided technical context.

Detection Methods for CVE-2024-43504

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, particularly cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel process crashes or exceptions in the Application event log referencing memory access violations shortly after opening a document.
Outbound network connections initiated by EXCEL.EXE to unfamiliar external hosts.
Newly created files in %APPDATA%, %TEMP%, or user profile paths written by an Excel process tree.

Detection Strategies

Hunt for parent-child process anomalies where EXCEL.EXE spawns interpreters or LOLBins (living-off-the-land binaries).
Alert on Office applications writing executable content (.exe, .dll, .js, .hta, .ps1) to disk.
Correlate Excel document opens from email attachments with subsequent script or macro-adjacent execution telemetry.

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized data lake for cross-source correlation.
Monitor Microsoft Defender ASR (Attack Surface Reduction) rule triggers, particularly the rule blocking Office child processes.
Track email gateway detections for spreadsheet attachments with suspicious macros, external links, or DDE content.

How to Mitigate CVE-2024-43504

Immediate Actions Required

Apply the Microsoft October 2024 security updates to all Excel, Office 2019, Office LTSC, and Microsoft 365 Apps installations.
Verify Microsoft 365 Apps update channels are current and clients have restarted to complete patch installation.
Enforce Protected View and block macros from the internet through Group Policy or Intune.
Restrict local administrative privileges to reduce blast radius if a user opens a malicious document.

Patch Information

Microsoft released fixes on October 8, 2024. Administrators should reference the Microsoft Security Update CVE-2024-43504 advisory for the specific build numbers applicable to each affected product SKU. Confirm patched build versions via File > Account > About Excel or through your endpoint management platform.

Workarounds

Enable Attack Surface Reduction rules to block Office applications from creating child processes and writing executable content.
Configure Group Policy to disable macros by default and require signed macros for trusted publishers.
Use email security controls to strip or sandbox spreadsheet attachments from untrusted senders.
Deliver user awareness training focused on unsolicited Excel attachments and enable-content prompts.

bash

# Configuration example: enable ASR rule to block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled