Vulnerability DatabaseCVE-2023-33150

CVE-2023-33150:
vulnerability analysis and mitigation

Overview

Microsoft Office Security Feature Bypass Vulnerability (CVE-2023-33150) was disclosed on July 11, 2023. This vulnerability affects multiple Microsoft Office products including Microsoft 365 Apps Enterprise (x64 and x86), Office 2019, Office 2021 LTSC, and Word 2013 (NVD).

Technical details

The vulnerability has been assigned a Critical severity rating with a CVSS v3.1 Base Score of 9.6 (CRITICAL) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The vulnerability is classified as a Protection Mechanism Failure (CWE-693) (NVD).

Impact

If successfully exploited, this security feature bypass vulnerability could lead to complete compromise of system confidentiality, integrity, and availability, as indicated by the high impact scores across all three security metrics in the CVSS rating (NVD).

Mitigation and workarounds

Microsoft has released security updates to address this vulnerability. Users should apply the security update KB5002406 for affected versions of Microsoft Word and other Office products. For Word 2016, both 32-bit and 64-bit versions have specific updates available through Microsoft Update, Microsoft Update Catalog, or Microsoft Download Center (Microsoft Support).