CVE-2024-20677: Microsoft Office Remote Code Execution Vulnerability
Microsoft · 3D Viewer
Vendor fix available · Affected: Microsoft 3D Viewer · Exploitation: possible (1 to 10%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 88% of scored CVEs
DescriptionCVE.org
A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it. This includes Office 2019, Office 2021, Office LTSC for Mac 2021, and Microsoft 365. As of February 13, 2024, the ability to insert FBX files has also been disabled in 3D Viewer. 3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time. This change is effective as of the January 9, 2024 security update.
Affected products5
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Microsoft · 3D Viewerfrom 7.0.0 before 7.2401.29012.0
- Microsoft · Microsoft Office 2019from 19.0.0 before https://aka.ms/OfficeSecurityReleases
- Microsoft · Microsoft 365 Apps for Enterprisefrom 16.0.1 before https://aka.ms/OfficeSecurityReleases
- Microsoft · Microsoft Office LTSC for Mac 2021from 16.0.1 before 16.81.24011420
- Microsoft · Microsoft Office LTSC 2021from 16.0.1 before https://aka.ms/OfficeSecurityReleases
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Microsoft
- Published
- January 2024
CoverageNo articles yet
No CyberSIXT article names CVE-2024-20677 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.