ZDI-23-1771: Microsoft Excel SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Excel. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2022-26804.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-23-1771?
The ZDI-23-1771 vulnerability has been assigned a CVSS rating indicating a significant risk due to its ability to allow remote code execution.
How do I fix ZDI-23-1771?
To fix ZDI-23-1771, ensure that you apply the latest security updates released by Microsoft for Excel.
Who is affected by ZDI-23-1771?
ZDI-23-1771 affects users of Microsoft Excel, particularly on Mac installations.
What are the exploit requirements for ZDI-23-1771?
Exploiting ZDI-23-1771 requires user interaction, meaning the target must visit a malicious webpage or open a harmful file.
What types of attacks can ZDI-23-1771 lead to?
ZDI-23-1771 can lead to remote code execution attacks, allowing attackers to run arbitrary code on the affected system.