CVE-2023-36884: Windows Search Remote Code Execution Vulnerability
Microsoft is investigating reports of a series of remote code execution vulnerabilities impacting Windows and Office products. Microsoft is aware of targeted attacks that attempt to exploit these vulnerabilities by using specially-crafted Microsoft Office documents.
An attacker could create a specially crafted Microsoft Office document that enables them to perform remote code execution in the context of the victim. However, an attacker would have to convince the victim to open the malicious file.
Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This might include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.
Please see the Microsoft Threat Intelligence Blog https://aka.ms/Storm-0978 Entry for important information about steps you can take to protect your system from this vulnerability.
This CVE will be updated with new information and links to security updates when they become available.
Other sources
Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.
— CISA
Windows Search Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.10240.20107Patch KB5029259 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.3324Patch KB5029244 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22621.2134Patch KB5029263 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19045.3324Patch KB5029244 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22000.2295Patch KB5029253 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.1906Fixed in 10.0.20348.1903Patch KB5029367 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.4737Patch KB5029247 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.9200.24414Patch KB5029308 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.1.7601.26664Patch KB5029307 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.6003.22216Patch KB5029301 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.6167Patch KB5029242 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.9600.21503Patch KB5029304
Event History
Frequently Asked Questions
What is the severity of CVE-2023-36884?
CVE-2023-36884 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-36884?
To remediate CVE-2023-36884, users should apply the latest security patches provided by Microsoft.
What products are affected by CVE-2023-36884?
CVE-2023-36884 impacts multiple Microsoft products including various versions of Windows and Microsoft Office.
Are there any known exploits for CVE-2023-36884?
Yes, there are reports of targeted attacks that exploit CVE-2023-36884 using specially-crafted Microsoft Office documents.
How can I tell if I am affected by CVE-2023-36884?
Users can determine if they are affected by CVE-2023-36884 by checking their version of Microsoft Office or Windows against the list of affected products.