Does CVE-2023-36884 impact Windows 10 with office 365 2302 or later installed?

Question

Does CVE-2023-36884 impact Windows 10 with office 365 2302 or later installed?

Answer 1

Microsoft 365 Semi-Annual Channel version 2302 (and all later versions) are protected from this vulnerability. Please see Update history for Microsoft 365 Apps (listed by date) for information about those channels and their versions.

Answer 2

Hello

Yes, the vulnerability CVE-2023-36884 impacts Microsoft Office and Windows HTML. Microsoft is investigating reports of a series of remote code execution vulnerabilities impacting Windows and Office products. However, I couldn’t find any specific information about whether it impacts Windows 10 with Office 365 version 2302 or later. You can check the Microsoft Security Response Center for updates and more information. It’s always a good idea to keep your software up to date with the latest security patches.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884

Answer 3

Per the link provided,

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884

You will see the following as part of the answer in the FAQ section.

"Microsoft 365 Semi-Annual Channel version 2302 (and all later versions) are protected from this vulnerability.."My concern is if you do not have office installed on the computer, like on servers, are you still vulnerable to this vulnerability? The article above indicates that all Microsoft operating systems are vulnerable, but also indicates the following:

"Microsoft is investigating reports of a series of remote code execution vulnerabilities impacting Windows and Office products. Microsoft is aware of targeted attacks that attempt to exploit these vulnerabilities by using specially-crafted Microsoft Office documents.

An attacker could create a specially crafted Microsoft Office document that enables them to perform remote code execution in the context of the victim. However, an attacker would have to convince the victim to open the malicious file."

I am still wondering if this impacts all windows operating systems even if office is not installed.