Critical Microsoft Vulnerability CVE-2023-XXXXX Allows Remote Code Execution

Microsoft has released security updates to address a critical vulnerability that could allow attackers to execute arbitrary code on affected systems. The vulnerability, tracked as CVE-2023-XXXXX, has a CVSS score of 8.8 and is being actively exploited in the wild.

Affected products include:

• Windows 10 (versions 21H2, 22H2)
• Windows 11 (version 22H2)
• Microsoft Office 2019, 2021
• Microsoft Exchange Server 2019, 2022

The vulnerability exists in the way Microsoft Office handles specially crafted files. An attacker who successfully exploits this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system.

Microsoft has rated this as critical for all affected products. The company recommends customers apply the updates immediately.

Mitigation steps:

1. Apply the security updates released on June 13, 2023
2. Enable the Microsoft Office Protected View feature
3. Block macros from the internet
4. Use the Windows Defender Application Control to restrict untrusted applications

The updates can be downloaded from the Microsoft Security Update Guide or through Windows Update.

Organizations should prioritize deploying these updates to critical systems within the next 72 hours. Microsoft has not provided a workaround for this vulnerability, making patching the only mitigation option.

For detailed information about the vulnerability and affected components, see the Microsoft Security Advisory.