Loading vulnerability…
Windows MSHTML Platform Security Feature Bypass
A security feature bypass vulnerability in the Windows MSHTML Platform allows an attacker to circumvent COM/OLE and OLE-related protections used by Microsoft 365 and Microsoft Office. Successful exploitation relies on delivering a specially crafted malicious file or document to a victim and inducing the victim to load or open it on a vulnerable Windows system. The flaw can bypass intended security controls in the MSHTML/OLE handling path and enable subsequent arbitrary code execution in the context of the logged-in user. The vulnerability has been reported as actively exploited in the wild.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can bypass security protections designed to restrict unsafe COM/OLE behavior and can lead to arbitrary code execution in the security context of the current user. Depending on that user’s privileges, this may allow installation of malware, data access, further compromise of the host, and follow-on activity under the user’s account. Because the vulnerability has been observed in active exploitation, it presents elevated operational risk.
If you can’t patch tonight, do this now.
Until patches are fully deployed, reduce exposure by limiting delivery and handling of untrusted documents and other files from email, web downloads, and instant messaging channels; enforce protected-view and document-handling hardening where available; restrict or disable unnecessary COM/OLE functionality in high-risk workflows; and apply least-privilege controls so users do not routinely operate with administrative rights. Additional compensating controls include attachment filtering, application control, and endpoint protections focused on malicious document execution chains.
Patch, then assume compromise.
Apply the Microsoft security updates released in May 2024 for affected Windows systems and associated Microsoft Office or Microsoft 365 environments. Prioritize patching internet-facing, user-workstation, and high-risk endpoints where users commonly receive documents through email or messaging platforms. Validate that all supported affected Windows versions have received the vendor fix and include this CVE in expedited remediation workflows due to its known exploited status.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.