CVE-2024-20677

A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it. This includes Office 2019, Office 2021, Office LTSC for Mac 2021, and Microsoft 365. As of February 13, 2024, the ability to insert FBX files has also been disabled in 3D Viewer. 3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time. This change is effective as of the January 9, 2024 security update.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20677	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:365_apps:-::::enterprise:::
	cpe:2.3:a:microsoft:office:2019:::::::*
	cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:::::-::
	cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:::::macos::

History

11 Apr 2024, 20:15

Type	Values Removed	Values Added
CWE		CWE-122

23 Mar 2024, 00:15

Type	Values Removed	Values Added
Summary	(en) A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it. This includes Office 2019, Office 2021, Office LTSC for Mac 2021, and Microsoft 365. 3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time. This change is effective as of the January 9, 2024 security update.	(en) A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it. This includes Office 2019, Office 2021, Office LTSC for Mac 2021, and Microsoft 365. As of February 13, 2024, the ability to insert FBX files has also been disabled in 3D Viewer. 3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time. This change is effective as of the January 9, 2024 security update.

26 Jan 2024, 01:15

Type	Values Removed	Values Added
Summary	(en) <p>A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it. This includes Office 2019, Office 2021, Office LTSC for Mac 2021, and Microsoft 365.</p> <p>3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time.</p> <p>This change is effective as of the January 9, 2024 security update.</p>	(en) A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it. This includes Office 2019, Office 2021, Office LTSC for Mac 2021, and Microsoft 365. 3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time. This change is effective as of the January 9, 2024 security update.

16 Jan 2024, 20:02

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
References	~~() https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20677 -~~	() https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20677 - Patch, Vendor Advisory
First Time		Microsoft office Microsoft office Long Term Servicing Channel Microsoft 365 Apps Microsoft
Summary		(es) <p>Existe una vulnerabilidad de seguridad en FBX que podría provocar la ejecución remota de código. Para mitigar esta vulnerabilidad, se deshabilitó la capacidad de insertar archivos FBX en Word, Excel, PowerPoint y Outlook para Windows y Mac. Las versiones de Office que tenían esta función habilitada ya no tendrán acceso a ella. Esto incluye Office 2019, Office 2021, Office LTSC para Mac 2021 y Microsoft 365.</p> <p>Los modelos 3D en documentos de Office que se insertaron previamente desde un archivo FBX seguirán funcionando como se espera a menos que se active la opción Vincular a Archivo. se eligió en el momento de la inserción.</p> <p>Este cambio entra en vigor a partir de la actualización de seguridad del 9 de enero de 2024.</p>
CPE		cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:::::macos:: cpe:2.3:a:microsoft:office:2019:::::::* cpe:2.3:a:microsoft:365_apps:-::::enterprise::: cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:::::-::

09 Jan 2024, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-09 18:15

Updated : 2024-04-11 20:15

NVD link : CVE-2024-20677

Mitre link : CVE-2024-20677

CVE.ORG link : CVE-2024-20677

JSON object : View

Products Affected

microsoft

office
office_long_term_servicing_channel
365_apps

CWE

NVD-CWE-noinfo CWE-122

Heap-based Buffer Overflow

7.8 /10