ZDI-CAN-20725: ZDI-23-385: Microsoft Office Word SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
Published Apr 11, 2023
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Office Word. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Affected Software
1 affected component
Microsoft Office Word
Event History
Apr 11, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-20725?
The severity of ZDI-CAN-20725 is rated at 61, indicating a moderate risk.
2
How do I fix ZDI-CAN-20725?
To fix ZDI-CAN-20725, ensure that your Microsoft Office Word is updated to the latest version available from Microsoft.
3
What type of vulnerability is ZDI-CAN-20725?
ZDI-CAN-20725 is a use-after-free vulnerability that can lead to remote code execution.
4
What is required for an attacker to exploit ZDI-CAN-20725?
An attacker needs user interaction to exploit ZDI-CAN-20725, such as convincing the user to visit a malicious page or open a malicious file.
5
Which software is affected by ZDI-CAN-20725?
ZDI-CAN-20725 affects installations of Microsoft Office Word.