Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.
What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker can successfully exploit this vulnerability by escaping the Protected View sandbox and running code at Standard User privileges. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? An attacker must send a user a malicious Office file and convince them to open it. Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector. According to the CVSS metric, the attack vector is local (AV:L). How could an attacker exploit this elevation of privilege vulnerability? This attack involves a compromised Protected View Sandbox sending crafted messages to its trusted user process. This causes the user process to execute arbitrary code originating from the sandbox at higher privileges.
Ben Faull with Microsoft