CVE-2024-43616: Microsoft 365 Apps RCE Vulnerability

CVE-2024-43616 Overview

CVE-2024-43616 is a remote code execution vulnerability affecting Microsoft Office and Microsoft 365 Apps. The flaw is rooted in an untrusted search path condition [CWE-426], allowing an attacker to place a malicious binary in a location searched by Office before the legitimate component is loaded. Successful exploitation requires local access and user interaction, but grants the attacker code execution in the context of the current user.

Microsoft assigned this issue a CVSS 3.1 base score of 7.8 and published it on October 8, 2024, as part of the monthly Patch Tuesday cycle.

Critical Impact
An attacker who successfully exploits CVE-2024-43616 can execute arbitrary code with the privileges of the user running Microsoft Office, leading to full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Office 2019
Microsoft Office Long Term Servicing Channel (LTSC) 2021 and 2024

Discovery Timeline

2024-10-08 - CVE-2024-43616 published to NVD and addressed by Microsoft in the October 2024 Security Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43616

Vulnerability Analysis

CVE-2024-43616 is a local remote code execution issue in Microsoft Office. The NVD categorizes the underlying weakness as [CWE-426] Untrusted Search Path. This class of flaw occurs when an application resolves a dependency, such as a Dynamic Link Library (DLL) or configuration file, using a search path that includes attacker-controllable locations.

Exploitation requires the target user to launch Office or open an Office document from a directory where the attacker has planted a malicious file. Once loaded, the payload runs inside the trusted Office process. From that context, attackers can drop follow-on malware, tamper with documents, harvest credentials cached by Office, or pivot into other Microsoft 365 services signed in on the host.

Root Cause

The root cause is Office resolving a library or component through an insecure search order. When a required module is not qualified by an absolute path, the loader consults locations such as the application's current working directory before system directories. An attacker who can write to one of those earlier-searched locations, for example a shared folder or a document-hosting directory, can supply a substitute binary that the loader accepts.

Attack Vector

The attack vector is local (AV:L) with required user interaction (UI:R). A typical scenario involves the attacker delivering a benign-looking Office document alongside a malicious DLL inside an archive or network share. When the victim opens the document from that directory, Office loads the planted DLL and executes attacker code. No elevated privileges are required for the attacker to stage the files, and no additional authentication is needed on the target.

Microsoft has not published a proof-of-concept, and the CVE is not listed on the CISA Known Exploited Vulnerabilities catalog at the time of writing. See the Microsoft Security Update Guide for the vendor's technical description.

Detection Methods for CVE-2024-43616

Indicators of Compromise

Unsigned or unexpected DLL files located next to Office documents (.docx, .xlsx, .pptx) inside archives, downloads, or removable media.
Office processes such as WINWORD.EXE, EXCEL.EXE, or POWERPNT.EXE loading modules from user-writable paths like %TEMP%, Downloads, or extracted archive directories.
Child processes spawned by Office binaries that execute LOLBins such as powershell.exe, rundll32.exe, regsvr32.exe, or cmd.exe.

Detection Strategies

Hunt for image loads by Office processes where the module path does not reside under C:\Program Files\Microsoft Office or C:\Windows\System32.
Correlate document opens from archive extraction directories with subsequent module loads and network egress from Office processes.
Alert on newly written DLLs in the same directory as a recently opened Office document within a short time window.

Monitoring Recommendations

Enable Sysmon Event ID 7 (Image Loaded) and Event ID 1 (Process Create) with an Office-focused configuration to capture DLL search-order behavior.
Forward Microsoft Defender for Endpoint or equivalent EDR telemetry covering Office.ProcessCreated and Office.ImageLoaded events to a central data lake for retrospective hunting.
Baseline the modules legitimately loaded by Office in your environment and alert on deviations.

How to Mitigate CVE-2024-43616

Immediate Actions Required

Apply the October 2024 Microsoft security updates for Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024 as described in the Microsoft Security Update Guide.
Inventory endpoints for vulnerable Office builds using configuration management or endpoint tooling and prioritize systems handling untrusted documents.
Instruct users to extract Office documents from archives to a controlled location before opening, rather than opening documents in place from download folders or removable media.

Patch Information

Microsoft released a patch for CVE-2024-43616 in the October 8, 2024 Patch Tuesday release. Consult the Microsoft Security Update Guide for the specific build numbers per channel: Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021 and 2024. Enable automatic updates through Click-to-Run or Microsoft Update to keep future revisions current.

Workarounds

Restrict write access to directories used to stage Office documents so that non-privileged users cannot plant DLLs alongside them.
Configure Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from loading unsigned modules.
Enforce Mark-of-the-Web propagation and Protected View for documents originating from the internet, email attachments, and network shares.

bash

# Enable ASR rule: Block Office applications from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled

# Enable ASR rule: Block Win32 API calls from Office macros
Add-MpPreference -AttackSurfaceReductionRules_Ids 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b -AttackSurfaceReductionRules_Actions Enabled

# Verify current ASR configuration
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids