CVE-2022-29107

Deeper analysis

Microsoft Office contains a security feature bypass vulnerability tracked as CVE-2022-29107. The flaw affects the Office suite on Windows and carries a CVSS 3.1 score of 5.5, reflecting local attack vector, low complexity, no required privileges, and required user interaction, resulting in high confidentiality impact without integrity or availability effects.

An attacker able to supply a malicious Office document can leverage the bypass once the file is opened by a user, allowing unauthorized disclosure of sensitive information stored on the local system. No remote code execution or privilege escalation is indicated by the provided scoring.

Microsoft Security Response Center advisories at the listed MSRC URLs contain the official guidance and patch information for affected Office installations. The associated EPSS values remain low, with a current score of 0.0585 and a peak of 0.0773, indicating limited observed exploitation interest after disclosure.