CVE-2023-28311

Deeper analysis

Microsoft Word contains a remote code execution vulnerability tracked as CVE-2023-28311 that stems from a heap-based buffer overflow, tracked under CWE-122. The flaw affects Microsoft Word and carries a CVSS 3.1 score of 7.8 with an attack vector that requires an attacker to supply a malicious file that the victim opens locally.

An unauthenticated attacker can exploit the issue by convincing a user to open a specially crafted document, after which arbitrary code executes with the privileges of the current user, resulting in full confidentiality, integrity, and availability impact on the affected system.

Microsoft security advisories hosted at the MSRC update guide for CVE-2023-28311 describe available patches and mitigation steps for supported versions of Word. The associated EPSS score rose from low values after disclosure to a peak of 0.1017 in January 2025 before receding to the current 0.0835, indicating a later surge in exploitation interest that warrants renewed attention.