Microsoft Publisher Protection Mechanism Failure Vulnerability
Description
Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Running Microsoft devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on Microsoft alerts
Turn on Microsoft alerts
Details
- Vendor
- Microsoft
- Product
- Microsoft Publisher
- CVE
- CVE-2024-38226
- Affected versions
- Office 2019: build not specified
Office LTSC 2021: build not specified
Publisher 2016: build not specified (from the advisory and NVD; check the exact builds in the official advisory) - CVSS score
- 7.3
- Actively exploited
- Yes, listed in the CISA Known Exploited Vulnerabilities catalog
- CISA due date
- October 1, 2024 (deadline for US federal agencies: a good benchmark for you too)
- Source
- CISA KEV – original advisory
- Published
- September 10, 2024
The description and the recommended action are quoted from the public advisory; severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.