cbcvebase.
CVE-2023-36041
published 2023-11-14

CVE-2023-36041: Microsoft Excel Remote Code Execution Vulnerability

PriorityP357high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
56.73%
99.0th percentile
Microsoft Excel Remote Code Execution Vulnerability

Affected

16 ranges
VendorProductVersion rangeFixed in
microsoftexcel
microsoftmicrosoft_365_apps_for_enterprise>= 16.0.1 < https://aka.ms/OfficeSecurityReleaseshttps://aka.ms/OfficeSecurityReleases
microsoftmicrosoft_excel_2016>= 16.0.0.0 < 16.0.5422.100016.0.5422.1000
microsoftmicrosoft_office_2019>= 19.0.0 < https://aka.ms/OfficeSecurityReleaseshttps://aka.ms/OfficeSecurityReleases
microsoftmicrosoft_office_ltsc_2021>= 16.0.1 < https://aka.ms/OfficeSecurityReleaseshttps://aka.ms/OfficeSecurityReleases
microsoftmicrosoft_office_ltsc_for_mac_2021>= 16.0.1 < 16.79.2311101916.79.23111019
microsoftoffice
microsoftoffice_long_term_servicing_channel
msrcmicrosoft_365_apps_for_enterprise_for_32-bit_systems
msrcmicrosoft_365_apps_for_enterprise_for_64-bit_systems
msrcmicrosoft_excel_2016
msrcmicrosoft_office_2019_for_32-bit_editions
msrcmicrosoft_office_2019_for_64-bit_editions
msrcmicrosoft_office_ltsc_2021_for_32-bit_editions
msrcmicrosoft_office_ltsc_2021_for_64-bit_editions
msrcmicrosoft_office_ltsc_for_mac_2021

Detection & IOCsextracted from sources · hover to see the quote

snort
62627, 62628, 62630 - 62633 and 62641 - 62644
snort
300751 - 300753, 300757 and 300758
  • Trigger on attempts to open a specially crafted Excel spreadsheet delivered via social engineering; the exploit is a use-after-free in ElementType attribute parsing in Microsoft Office Professional Plus 2019 Excel.
  • The attack vector is local and requires user interaction — monitor for Excel process spawning unexpected child processes or shellcode activity after a user opens an untrusted .xlsx/.xls file.
  • ·Snort rules listed cover multiple November 2023 Patch Tuesday CVEs, not exclusively CVE-2023-36041; confirm which rule SIDs specifically target TALOS-2023-1835 before deploying.
  • ·Additional Snort rules may be released at a future date and current rules are subject to change pending additional information.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.