CVE-2019-1297
Microsoft Excel 2010 … 2016
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2019-1297 is a high-severity an unspecified weakness vulnerability in Microsoft Excel. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory. The flaw affects Microsoft Excel and carries a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no required privileges, and required user interaction.
An attacker can exploit the issue by supplying a specially crafted Excel document that triggers the memory-handling flaw, resulting in arbitrary code execution with the privileges of the current user and full impact on confidentiality, integrity, and availability.
Microsoft security advisories referenced by the CVE provide patch information and mitigation guidance, while the CISA Known Exploited Vulnerabilities catalog confirms that the vulnerability has been leveraged in real-world attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-9862
Vulnerability Data
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
- CWE(s)
- KEV Date Added
- 03 March 2022
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.