CVE-2022-38048
Published: 11 October 2022
Summary
CVE-2022-38048 is a high-severity an unspecified weakness vulnerability in Microsoft Office. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 9.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Office contains a remote code execution vulnerability tracked as CVE-2022-38048. The flaw received a CVSS 3.1 score of 7.8 with an attack vector of local access, low complexity, no privileges required, and user interaction needed, resulting in high impact to confidentiality, integrity, and availability.
An attacker can exploit the issue by supplying a malicious file that a user opens locally in an affected Microsoft Office application, enabling arbitrary code execution on the target system without additional authentication.
Microsoft has published security guidance and updates addressing the vulnerability through its MSRC portal at the referenced advisory URLs.
The associated EPSS score remains at 0.0613 with no material increase from its initial value.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-40654
Vulnerability details
Microsoft Office Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.