KLA78976 Multiple vulnerabilities in Microsoft Office

🗓️ 14 Jan 2025 00:00:00Reported by Kaspersky LabType

kaspersky

kaspersky🔗 threats.kaspersky.com👁 34 Views

Multiple vulnerabilities in Microsoft Office allow code execution, privilege escalation, and spoofing attacks.

Reporter	Title	Published	Views	Family All 302
Information Security Automation	January Microsoft Patch Tuesday	14 Jan 202523:22	–	avleonov
BDU FSTEC	The vulnerability of the GDI+ component in Microsoft Office programs and the Windows operating system allows a hacker to execute arbitrary code.	22 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Microsoft 365 Apps for Enterprise, Microsoft Office, and the Microsoft Access database management system arises from buffer overflows in dynamic memory, allowing an attacker to execute arbitrary code.	22 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise programs relates to the use of memory after it is freed, allowing an attacker to execute arbitrary code.	22 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Microsoft Office software package and the Microsoft Outlook email client arises from incorrect restrictions on file names and other resources, allowing an attacker to execute arbitrary code.	23 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Microsoft Office package, Microsoft 365 Apps for Enterprise, and the Microsoft Outlook email client relates to the use of an uninitialized resource, allowing a perpetrator to execute arbitrary code.	23 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to deserialization mechanism flaws, which allows attackers to circumvent existing security restrictions.	23 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages relates to the use of an insecure search path, allowing a perpetrator to execute arbitrary code.	23 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability in Microsoft Word, Microsoft Office suites, and Microsoft 365 Apps for Enterprise allows a perpetrator to execute arbitrary code.	23 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Microsoft AutoUpdate (MAU) application for Mac, which manages privileges in a non-safe manner, allows a malicious individual to escalate their privileges.	23 Jan 202500:00	–	bdu_fstec

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21354
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21356
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21345
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21344
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21364
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21402
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21393
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21348
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21346
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21362

13 Feb 2025 00:00Current

8.9High risk

Vulners AI Score8.9

CVSS 3.17.8 - 8.4

EPSS0.01742

SSVC

microsoft office vulnerabilities remote code execution security feature bypass privilege escalation spoofing attacks.