CVE-2023-21741
Published: 10 January 2023
Summary
CVE-2023-21741 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Microsoft Visio. Its CVSS base score is 7.1 (High).
Operationally, ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-21741 is an information disclosure vulnerability in Microsoft Office Visio stemming from an out-of-bounds read condition (CWE-125). It carries a CVSS 3.1 base score of 7.1 reflecting network attack vector, low complexity, low privileges required, and no user interaction, resulting in high confidentiality impact together with limited availability consequences.
An authenticated attacker positioned on the network can send a specially crafted Visio file or session to the affected application and obtain sensitive information from memory without any user interaction, while also inducing a partial denial-of-service condition.
The official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21741 supplies patch guidance and should be consulted for remediation steps. Exploitation probability remains low, with an EPSS score of 0.0644 that has shown no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25908
Vulnerability details
Microsoft Office Visio Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.