CVE-2024-43505: Microsoft Office Visio RCE Vulnerability

CVE-2024-43505 Overview

CVE-2024-43505 is a remote code execution vulnerability affecting Microsoft Office Visio. Despite the "remote code execution" label, the CVSS vector indicates a local attack vector requiring user interaction. An attacker must convince a user to open a malicious Visio file to trigger the flaw. Successful exploitation results in code execution in the context of the current user, with high impact to confidentiality, integrity, and availability. The vulnerability is mapped to [CWE-357] (Insufficient UI Warning of Dangerous Operations) and affects Microsoft 365 Apps, Microsoft Office 2019, and Office LTSC 2021 and 2024.

Critical Impact
Attackers can execute arbitrary code on affected systems by tricking users into opening a crafted Microsoft Office Visio file, leading to full compromise of the user context.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Office 2019
Microsoft Office LTSC 2021 and 2024

Discovery Timeline

2024-10-08 - CVE-2024-43505 published to the National Vulnerability Database
2024-10-08 - Microsoft released a security update via the Microsoft Security Response Center advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43505

Vulnerability Analysis

CVE-2024-43505 exists in Microsoft Office Visio's handling of crafted document files. The weakness allows an attacker to bypass or bypass-adjacent security prompts intended to warn users about dangerous operations, aligning with [CWE-357]. When a targeted user opens a malicious Visio file, the application processes attacker-controlled content and executes code within the user's security context. Because Visio and other Office applications share components across the Microsoft 365 Apps and Office LTSC channels, the vulnerability spans multiple maintained Office releases.

Exploitation yields arbitrary code execution with the privileges of the logged-on user. If the target is a local administrator, attackers can install programs, view, change, or delete data, or create accounts with full rights. The user interaction requirement narrows opportunistic exploitation but does not prevent targeted phishing or supply-chain scenarios where Visio files are routinely shared.

Root Cause

The root cause is insufficient warning or validation when Visio processes specific document content. The application does not adequately prevent dangerous operations triggered by attacker-controlled elements within the file, allowing execution paths that should require explicit user consent to proceed silently or with misleading prompts.

Attack Vector

The attack vector is local and requires user interaction. A typical exploitation chain involves delivering a weaponized .vsd, .vsdx, or related Visio document via email, chat, cloud share, or malicious website. The user opens the file, and the vulnerable Visio component processes the crafted content, executing attacker-supplied code. No authentication is required on the attacker side, and no elevated privileges are needed on the victim host beyond the ability to open the document.

No verified public proof-of-concept code is available for CVE-2024-43505. See the Microsoft advisory for technical details.

Detection Methods for CVE-2024-43505

Indicators of Compromise

Unexpected child processes spawned by visio.exe, particularly cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, or rundll32.exe.
Visio documents delivered from external senders that trigger outbound network connections shortly after being opened.
Creation of executable files, scripts, or scheduled tasks in user-writable directories such as %APPDATA%, %LOCALAPPDATA%, or %TEMP% following Visio activity.
Office telemetry showing Visio loading unusual COM objects or add-ins immediately before anomalous process activity.

Detection Strategies

Deploy behavioral detection rules that alert on Office applications, including visio.exe, spawning script interpreters or LOLBins.
Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting into other processes.
Hunt for command lines containing encoded PowerShell (-enc, -encodedcommand) launched by any Office binary.
Correlate email gateway metadata for inbound Visio attachments with endpoint process telemetry to identify delivery-to-execution chains.

Monitoring Recommendations

Monitor Microsoft Office patch levels across all endpoints to confirm the October 2024 security updates are installed.
Track file writes to Office Startup and AddIns directories, which are common persistence locations abused after Office exploitation.
Log and review Visio file activity from removable media, cloud sync clients, and web downloads.

How to Mitigate CVE-2024-43505

Immediate Actions Required

Apply the October 2024 Microsoft security updates to all affected Microsoft 365 Apps, Office 2019, and Office LTSC 2021 and 2024 installations.
Prioritize patching workstations used by high-value or high-exposure users such as executives, IT administrators, and staff who routinely handle external Visio files.
Confirm that Microsoft Update, WSUS, or Intune deployment rings have completed rollout and remediate systems that report failed installations.

Patch Information

Microsoft published the fix in the security update referenced by the Microsoft Security Response Center advisory for CVE-2024-43505. Administrators should consult the advisory for the specific build numbers that correspond to each affected channel and version of Microsoft 365 Apps and Office.

Workarounds

Enable Protected View and Office Protected View for files originating from the internet or other untrusted locations.
Configure Microsoft Defender ASR rules to block child process creation and Win32 API calls from Office applications until patches are fully deployed.
Block or quarantine Visio file types at the email gateway when they originate from external senders and are not required for business.
Restrict end-user local administrator rights to limit the impact of code executed in the user's context.

bash

# Enable ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled