CVE-2023-28285

Deeper analysis

Microsoft Office contains a remote code execution vulnerability tracked as CVE-2023-28285. The flaw is a use-after-free condition (CWE-416) that affects multiple versions of the Office suite on Windows. It carries a CVSS 3.1 score of 7.8 with an attack vector of local access, low complexity, no required privileges, and user interaction, resulting in high impact to confidentiality, integrity, and availability.

An attacker can exploit the issue by supplying a specially crafted Office document that the victim must open. Successful exploitation grants arbitrary code execution in the context of the current user, allowing full compromise of the affected system without further privilege escalation in many configurations.

Microsoft’s advisory at msrc.microsoft.com directs customers to apply the security updates released on April 11, 2023, which remediate the vulnerability across supported Office builds. The same guidance lists the affected products and the corresponding KB articles for each version.

EPSS for the CVE rose from a low baseline to a peak of 0.0982 on 2025-01-22 before receding to the current value of 0.0182, indicating that exploitation interest increased well after initial disclosure.