Kaspersky Commentary - Zero-day vulnerability in Microsoft Office

While details remain limited, Microsoft’s guidance indicates that this vulnerability is triggered when a user opens a specially crafted Microsoft Office file. This action inadvertently forces the system to load the legacy Internet Explorer engine, allowing attackers to exploit that environment to achieve Remote Code Execution (RCE) on the victim’s computer.

Since Microsoft reported discovering this in the wild, it is clear that active exploitation is already underway. We at Kaspersky have observed a significant number of exploits utilizing similar technique in the past — such as CVE-2018-8174. Although Microsoft has ceased updating Internet Explorer, they had previously introduced additional security measures to prevent its misuse in this manner — defenses this new exploit appears to circumvent.