Important MS Office Update Interrupts Actively Exploited RCE Attacks

Microsoft published details about a number of security gaps on August Patch Day. This includes some vulnerabilities that affect various Office applications – including a zero-day vulnerability that has been known for weeks.

BSI warns against active exploitation

The Federal Office for Information Security in Germany warned of this vulnerability in July after it became known that the hacker group Storm-0978 had used this HTML Remote Code Execution (RCE) vulnerability to attack the NATO summit in the Baltic States.

Although Microsoft also published details on CVE-2023-36884 in July and gave tips on how to limit the damage, it only closed the vulnerability in August.

The bug was originally reported as an RCE in Microsoft Office, but upon further investigation, it was classified as a critical remote code execution in Windows Search.

In a newly published advisory, Microsoft now describes the Office updates as a “measure to improve security as part of a comprehensive defense”. Further information from the company explains that the update is intended to stop the chain of attacks that triggers CVE-2023-36884.

Office and Windows updates required

Microsoft, therefore, recommends installing the Office updates and Windows updates released for August Patch Day as soon as possible. Microsoft is patching the Office suite from the years 2013/2016/2019 along with all applications for both 32-bit and 64-bit architectures.

In the original announcement, Microsoft states that an attacker could exploit the vulnerability by sending a specially crafted file via email or message. User interaction is also required – so the hackers have to set a lure for the victims to open the email and launch the file.