CVE-2023-36884: Windows Search Remote Code Execution Vulnerability
First published: Tue Jul 11 2023(Updated: )
Microsoft is investigating reports of a series of remote code execution vulnerabilities impacting Windows and Office products. Microsoft is aware of targeted attacks that attempt to exploit these vulnerabilities by using specially-crafted Microsoft Office documents. An attacker could create a specially crafted Microsoft Office document that enables them to perform remote code execution in the context of the victim. However, an attacker would have to convince the victim to open the malicious file. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This might include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs. Please see the Microsoft Threat Intelligence Blog https://aka.ms/Storm-0978 Entry for important information about steps you can take to protect your system from this vulnerability. This CVE will be updated with new information and links to security updates when they become available.
Credit: secure@microsoft.com secure@microsoft.com secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Word 2016 | ||
| Microsoft Word 2016 | ||
| Microsoft Word 2013 | ||
| Microsoft Word 2013 | ||
| Microsoft Office 2019 for 32-bit editions | ||
| Microsoft Office 2019 for 64-bit editions | ||
| Microsoft Office LTSC 2021 for 32-bit editions | ||
| Microsoft Office LTSC 2021 for 64-bit editions | ||
| Microsoft Windows 11 | =22H2 | |
| Microsoft Windows 11 | =22H2 | |
| Microsoft Windows 11 | =21H2 | |
| Microsoft Windows 11 | =21H2 | |
| Microsoft Windows Server 2022 | ||
| Microsoft Windows Server 2022 | ||
| Microsoft Windows Server 2019 | ||
| Microsoft Windows Server 2019 | ||
| Microsoft Windows 10 | =1809 | |
| Microsoft Windows 10 | =1809 | |
| Microsoft Windows 10 | =1809 | |
| Microsoft Windows 10 | =22H2 | |
| Microsoft Windows 10 | =22H2 | |
| Microsoft Windows 10 | =22H2 | |
| Microsoft Windows 10 | =21H2 | |
| Microsoft Windows 10 | ||
| Microsoft Windows 10 | ||
| Microsoft Windows 10 | =21H2 | |
| Microsoft Windows 10 | =21H2 | |
| Microsoft Windows Server 2008 R2 | ||
| Microsoft Windows Server 2008 R2 | ||
| Microsoft Windows 10 | =21H2 | |
| Microsoft Windows 10 | =1809 | |
| Microsoft Windows 11 | =21H2 | |
| Microsoft Windows Server 2019 | ||
| Microsoft Windows Server 2012 R2 | ||
| Microsoft Windows 10 | =21H2 | |
| Microsoft Windows 11 | =21H2 | |
| Microsoft Windows 10 | ||
| Microsoft Windows 10 | =1809 | |
| Microsoft Windows 10 | =22H2 | |
| Microsoft Windows 10 | =1607 | |
| Microsoft Windows 10 | ||
| Microsoft Windows Server 2022 | ||
| Microsoft Windows 11 | =22H2 | |
| Microsoft Windows 11 | =22H2 | |
| Microsoft Windows Server 2012 R2 | ||
| Microsoft Windows 10 | =1809 | |
| Microsoft Windows Server 2022 | ||
| Microsoft Windows Server 2019 | ||
| Microsoft Windows 10 | =21H2 | |
| Microsoft Windows 10 | =22H2 | |
| Microsoft Windows 10 | =22H2 | |
| Microsoft Windows 10 | =1607 | |
| Microsoft Windows Server 2016 | ||
| Microsoft Windows Server 2016 | ||
| Microsoft Windows | ||
| Microsoft Windows Server 2012 x64 | ||
| Microsoft Windows Server 2012 x64 | ||
| Microsoft Windows Server 2008 Itanium | ||
| Microsoft Windows Server 2008 Itanium | ||
| Microsoft Windows 10 1507 | <10.0.10240.20107 | |
| Microsoft Windows 10 Version 1607 x86 | <10.0.14393.6167 | |
| Microsoft Windows 10 Version 1607 x86 | <10.0.14393.6167 | |
| Microsoft Windows 10 1809 | <10.0.17763.4737 | |
| Microsoft Windows 10 1809 | <10.0.17763.4737 | |
| Microsoft Windows 10 1809 | <10.0.17763.4737 | |
| Microsoft Windows 10 21h2 | <10.0.19044.3324 | |
| Microsoft Windows 10 22h2 | <10.0.19044.3324 | |
| Microsoft Windows 11 21h2 | <10.0.22000.2295 | |
| Microsoft Windows 11 22h2 | <10.0.22621.2134 | |
| Microsoft Windows Server 2008 Itanium | =sp2 | |
| Microsoft Windows Server 2008 Itanium | =r2-sp1 | |
| Microsoft Windows Server 2012 x64 | ||
| Microsoft Windows Server 2012 x64 | =r2 | |
| Microsoft Windows Server 2016 | <10.0.14393.6167 | |
| Microsoft Windows Server 2019 | <10.0.17763.4737 | |
| Microsoft Windows Server 2022 | <10.0.20348.1903 | |
| Microsoft Windows Server 2008 Itanium | ||
| Microsoft Windows Server 2008 Itanium | ||
| Microsoft Office | =2019 | |
| Microsoft Office | =2019 | |
| Microsoft Office | =2021 | |
| Microsoft Office | =2021 | |
| Microsoft Word for Android | =2013-sp1 | |
| Microsoft Word for Android | =2016 | |
| Microsoft Windows 10 1507 | ||
| Microsoft Windows 10 1507 | ||
| Microsoft Windows 10 Version 1607 x86 | ||
| Microsoft Windows 10 Version 1607 x86 | ||
| Microsoft Windows 10 1809 | ||
| Microsoft Windows 10 1809 | ||
| Microsoft Windows 10 1809 | ||
| Microsoft Windows 10 21h2 | ||
| Microsoft Windows 10 21h2 | ||
| Microsoft Windows 10 21h2 | ||
| Microsoft Windows 10 22h2 | ||
| Microsoft Windows 10 22h2 | ||
| Microsoft Windows 10 22h2 | ||
| Microsoft Windows 11 | =22h2 | |
| Microsoft Windows 11 | =22h2 | |
| Microsoft Windows 11 21h2 | ||
| Microsoft Windows 11 21h2 | ||
| Microsoft Windows Server 2016 | ||
| Microsoft Windows Server 2019 | ||
| Microsoft Windows Server 2022 |
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884 (Advisory)
- http://seclists.org/fulldisclosure/2023/Jul/43
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884;
- https://nvd.nist.gov/vuln/detail/CVE-2023-36884
- https://www.bleepingcomputer.com/news/security/underground-ransomware-claims-attack-on-casio-leaks-stolen-data/
- https://www.bleepingcomputer.com/news/security/firefox-and-windows-zero-days-exploited-by-russian-romcom-hackers/
- https://www.theregister.com/2024/12/01/interpol_cybercrime_busting/
Frequently Asked Questions
What is the severity of CVE-2023-36884?
CVE-2023-36884 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-36884?
To remediate CVE-2023-36884, users should apply the latest security patches provided by Microsoft.
What products are affected by CVE-2023-36884?
CVE-2023-36884 impacts multiple Microsoft products including various versions of Windows and Microsoft Office.
Are there any known exploits for CVE-2023-36884?
Yes, there are reports of targeted attacks that exploit CVE-2023-36884 using specially-crafted Microsoft Office documents.
How can I tell if I am affected by CVE-2023-36884?
Users can determine if they are affected by CVE-2023-36884 by checking their version of Microsoft Office or Windows against the list of affected products.
- collector/msrc
- collector/msrc-cve
- agent/type
- agent/first-publish-date
- exploited/true
- source/Microsoft
- agent/remedy
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/title
- agent/severity
- agent/weakness
- agent/description
- ransomware/true
- collector/cisa-known-exploited
- source/CISA
- agent/author
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2023-36884
- alias/CVE-2024-9680
- alias/CVE-2024-49039
- collector/the-register
- source/The Register
- alias/CVE-2023-28461
- agent/references
- agent/event
- agent/trending
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/last-modified-date
- collector/nvd-cve
- source/NVD
- collector/nvd-api
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- collector/nvd-latest
- vendor/microsoft
- canonical/microsoft word 2016
- canonical/microsoft word 2013
- canonical/microsoft office 2019 for 32-bit editions
- canonical/microsoft office 2019 for 64-bit editions
- canonical/microsoft office ltsc 2021 for 32-bit editions
- canonical/microsoft office ltsc 2021 for 64-bit editions
- canonical/microsoft windows 11
- version/microsoft windows 11/22h2
- version/microsoft windows 11/21h2
- canonical/microsoft windows server 2022
- canonical/microsoft windows server 2019
- canonical/microsoft windows 10
- version/microsoft windows 10/1809
- version/microsoft windows 10/22h2
- version/microsoft windows 10/21h2
- canonical/microsoft windows server 2008 r2
- canonical/microsoft windows server 2012 r2
- version/microsoft windows 10/1607
- canonical/microsoft windows server 2016
- canonical/microsoft windows
- canonical/microsoft windows server 2012 x64
- canonical/microsoft windows server 2008 itanium
- canonical/microsoft windows 10 1507
- canonical/microsoft windows 10 version 1607 x86
- canonical/microsoft windows 10 1809
- canonical/microsoft windows 10 21h2
- canonical/microsoft windows 10 22h2
- canonical/microsoft windows 11 21h2
- canonical/microsoft windows 11 22h2
- version/microsoft windows server 2008 itanium/sp2
- version/microsoft windows server 2008 itanium/r2-sp1
- version/microsoft windows server 2012 x64/r2
- canonical/microsoft office
- version/microsoft office/2019
- version/microsoft office/2021
- canonical/microsoft word for android
- version/microsoft word for android/2013-sp1
- version/microsoft word for android/2016