CVE-2022-26804: 
vulnerability analysis and mitigation

Microsoft Office Graphics Remote Code Execution Vulnerability (CVE-2022-26804) is a security flaw that affects Microsoft Excel and Microsoft 365 Apps for Enterprise. The vulnerability was disclosed on December 13, 2022, and received a CVSS v3 Base Score of 7.8 (High) (AttackerKB, ZDI).

The vulnerability specifically exists within the parsing of SKP files in Microsoft Excel. The issue stems from the lack of validating the existence of an object prior to performing operations on the object, resulting in a Use-After-Free condition that could lead to remote code execution. The vulnerability has been assigned a CVSS score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector, low attack complexity, no privileges required, and user interaction required (ZDI).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process, potentially leading to full system compromise with the same privileges as the victim user. The vulnerability affects confidentiality, integrity, and availability, all rated as High in the CVSS scoring (ZDI).

Microsoft has released security updates to address this vulnerability. Users are advised to apply the latest security updates available through the Microsoft Security Response Center (ZDI).