CVE-2023-33133
Published: 14 June 2023
Summary
CVE-2023-33133 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Excel. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 2.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Excel contains a remote code execution vulnerability tracked as CVE-2023-33133 and assigned a CVSS score of 7.8. The flaw is associated with CWE-122 and affects the application's handling of certain inputs, enabling code execution when a crafted document is processed.
An unauthenticated attacker can exploit the issue by supplying a malicious Excel file that a user must open locally. Successful exploitation grants high-impact control over confidentiality, integrity, and availability on the target system without requiring elevated privileges.
Microsoft has published remediation guidance in its Security Response Center advisory for this vulnerability, and additional technical analysis is available from Cisco Talos. The associated EPSS score has remained at 0.3721 since disclosure with no material increase observed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-37319
Vulnerability details
Microsoft Excel Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.