Loading vulnerability…
Microsoft Project Remote Code Execution Vulnerability
CVE-2024-38189 is a remote code execution vulnerability in Microsoft Project triggered when a user opens a specially crafted Project file. Exploitation requires macros to be permitted and the Office policy blocking macros from the internet to be disabled. The vulnerability has a CVSS v3.1 score of 8.8 and was actively exploited before Microsoft released fixes in August 2024.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows attacker-controlled code to execute on the affected system, potentially compromising data and resources accessible to the user running Microsoft Project. Exploitation does not by itself establish elevation to administrator or SYSTEM privileges.
If you can’t patch tonight, do this now.
Until updates are deployed, prevent users from opening untrusted Microsoft Project files. Enforce the Office policy blocking macros from the internet and restrict macro execution to reduce exposure to the documented exploitation conditions.
Patch, then assume compromise.
Install the applicable Microsoft Project security updates from the August 2024 Microsoft security release, or superseding updates that include the fix. Use the product-specific Microsoft security advisory to identify the appropriate update for each installed version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.