Loading vulnerability…
Microsoft Publisher Office Macro Policy Security Feature Bypass
CVE-2024-38226 is a security feature bypass vulnerability in Microsoft Publisher that can allow Office macro policy protections to be circumvented. The issue affects Microsoft Publisher and related Office product versions identified in September 2024 security updates, including references to Publisher 2016 and Office 2019/2021. Successful exploitation allows a crafted Publisher file to evade macro-related trust controls intended to block macros in untrusted or malicious files. Available reporting indicates the vulnerability was exploited in the wild as a zero-day. The Preview Pane is not considered an attack vector for this issue.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to bypass Office macro policy protections that are intended to prevent macros from running from untrusted content. This can reduce or eliminate a key trust boundary in Office document handling and may enable follow-on malicious activity such as execution of attacker-controlled macro content, initial access, or delivery of additional payloads in environments that rely on macro blocking policies for protection.
If you can’t patch tonight, do this now.
Until patches are fully deployed, reduce exposure by preventing users from downloading and opening untrusted Publisher documents, enforcing strict application control for Office child-process and macro execution behaviors, and using attachment and content filtering to block or quarantine suspicious Publisher files. Because the vulnerability is tied to bypass of macro trust controls, organizations should also harden Office execution policies and monitor for abnormal Publisher-initiated activity.
Patch, then assume compromise.
Apply Microsoft's September 2024 security updates for all affected Microsoft Publisher and Office installations. Upgrade affected Publisher and Office versions to the patched builds provided by Microsoft and ensure enterprise update channels have fully deployed the relevant fixes across endpoints.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.