CVE-2022-22003: 
vulnerability analysis and mitigation

Microsoft Office Graphics Remote Code Execution Vulnerability (CVE-2022-22003) was disclosed on February 8, 2022. This vulnerability affects various Microsoft Office products including Microsoft 365 Apps Enterprise, Office 2013 SP1, Office 2016, Office 2019, and Office Long Term Servicing Channel 2021, across different platforms including x64, x86, and macOS versions (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Under CVSS v2.0, it received a base score of 6.8 (MEDIUM) with the vector (AV:N/AC:M/Au:N/C:P/I:P/A:P). The vulnerability requires user interaction for successful exploitation (NVD).

This vulnerability could allow an attacker to execute remote code on affected systems, potentially compromising the confidentiality, integrity, and availability of the system. The high CVSS score indicates significant potential impact if successfully exploited (Rapid7).

Microsoft has released security updates to address this vulnerability. The fix is available through KB5002140 for affected Microsoft Office versions (Rapid7).