CVE-2023-21741: Microsoft Office Visio Information Disclosure Vulnerability

Overview

Severity

High (CVSS 7.1)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C

Category

Information Disclosure

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2023-Jan

Released

2023-01-10

EPSS Score

6.04% (percentile: 90.7%)

FAQ

What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is remote heap memory. According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of availability (A:L)? What does that mean for this vulnerability? The performance can be interrupted and/or reduced, but the attacker cannot fully deny service.

Affected Products (10)

Microsoft Office

• Microsoft Office LTSC 2021 for 64-bit editions
• Microsoft Office LTSC 2021 for 32-bit editions
• Microsoft Visio 2013 Service Pack 1 (64-bit editions)
• Microsoft Visio 2013 Service Pack 1 (32-bit editions)
• Microsoft 365 Apps for Enterprise for 32-bit Systems
• Microsoft Office 2019 for 64-bit editions
• Microsoft Office 2019 for 32-bit editions
• Microsoft 365 Apps for Enterprise for 64-bit Systems
• Microsoft Visio 2016 (64-bit edition)
• Microsoft Visio 2016 (32-bit edition)

Security Updates (4)

• 5002332
• 5002332
• 5002337
• 5002337

Acknowledgments

HAO LI of VenusTech ADLab

Revision History

• 2023-01-10: Information published.