CVE-2019-1462: Microsoft PowerPoint PPT File Use-After-Free Remote Code Execution Vulnerability
First published: Tue Dec 10 2019(Updated: )
A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft PowerPoint Remote Code Execution Vulnerability'.
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Office Mac Os | =2016 | |
| Microsoft Office | =2019 | |
| Microsoft Office | =2019 | |
| Microsoft Office 365 Proplus | ||
| Microsoft PowerPoint | =2010-sp2 | |
| Microsoft PowerPoint | =2013-sp1 | |
| Microsoft PowerPoint | =2016 | |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-1462?
CVE-2019-1462 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of Microsoft PowerPoint.
How does CVE-2019-1462 work?
CVE-2019-1462 is a use-after-free vulnerability that exists within the processing of PowerPoint PPT files. By visiting a malicious page or opening a malicious PPT file, an attacker can exploit this vulnerability and execute arbitrary code.
What software is affected by CVE-2019-1462?
CVE-2019-1462 affects Microsoft PowerPoint versions 2010 SP2, 2013 SP1, 2016, Microsoft Office 2016 for Mac, Microsoft Office 2019, Microsoft Office 2019 for macOS, and Microsoft Office 365 ProPlus.
How severe is CVE-2019-1462?
The severity of CVE-2019-1462 is critical, with a CVSSv3 score of 7.8.
How can I mitigate CVE-2019-1462?
To mitigate CVE-2019-1462, apply the necessary security updates provided by Microsoft. Additionally, be cautious when opening PPT files from untrusted sources.
- agent/references
- agent/type
- agent/author
- agent/title
- agent/remedy
- agent/weakness
- agent/severity
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- agent/softwarecombine
- agent/event
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-19-1006
- alias/ZDI-CAN-9339
- alias/CVE-2019-1462
- agent/software-canonical-lookup
- vendor/microsoft
- canonical/microsoft office mac os
- version/microsoft office mac os/2016
- canonical/microsoft office
- version/microsoft office/2019
- canonical/microsoft office 365 proplus
- canonical/microsoft powerpoint
- version/microsoft powerpoint/2010-sp2
- version/microsoft powerpoint/2013-sp1
- version/microsoft powerpoint/2016