ZDI-CAN-19241: ZDI-23-1790: Microsoft Excel SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Dec 14, 2023

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Excel. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2023-33146.

Affected Software

1 affected component

Microsoft Excel

Event History

Dec 14, 2023

Advisory Published

06:00 AM

Data Sourced

06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-19241?

ZDI-CAN-19241 has been assigned a high severity rating by the Zero Day Initiative.

How do I fix ZDI-CAN-19241?

To fix ZDI-CAN-19241, ensure that you apply the latest security updates provided by Microsoft for Excel.

What type of attacks does ZDI-CAN-19241 enable?

ZDI-CAN-19241 enables remote attackers to execute arbitrary code on affected installations of Microsoft Excel.

What software is affected by ZDI-CAN-19241?

ZDI-CAN-19241 affects Microsoft Excel for Mac installations.

What is required for an attacker to exploit ZDI-CAN-19241?

User interaction is required to exploit ZDI-CAN-19241, as the target must visit a malicious page or open a malicious file.