Buffer overflow in Microsoft 365_apps
CVE-2024-20677
A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Offi…
Vulnerability class: Buffer Overflow
EPSS: 0.033 (86.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Microsoft 365_apps
- Microsoft 3d Viewer — versions 7.0.0
- Microsoft 365 Apps For Enterprise — versions 16.0.1
- Microsoft Office 2019 — versions 19.0.0
- Microsoft Office Ltsc 2021 — versions 16.0.1
- Microsoft Office Ltsc For Mac 2021 — versions 16.0.1
- Microsoft Office — versions 2019
- Microsoft Office_long_term_servicing_channel — versions 2021
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secure@microsoft.com (vendor-advisory, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-20677?
- CVE-2024-20677 is a high-severity vulnerability in Microsoft 365_apps, classified under Heap-based Buffer Overflow. CVSS score: 7.8/10. Published 2024-01-09.
- How severe is CVE-2024-20677?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2024-20677 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.