A Defense-In-Depth Office update has been released by Microsoft as a part of the Patch Tuesday updates made available this week to fix an actively exploited remote code execution (RCE) flaw. This vulnerability was first identified last month, when it was confirmed to be actively exploited and publicly disclosed. At the time of discovery, it was thought to be an RCE flaw in Microsoft Office, however it was later determined to actually occur within Windows Search. Microsoft only released mitigation information last month and not an official patch, however the original security bulletin has since been updated to include the details of the updates released this week that patch this flaw.  

This Windows Search RCE vulnerability tracked as CVE-2023-36884 has been given a high severity rating, and a CVSS base score of 8.8. Known exploitation of this flaw has been attributed to the threat actor known as RomCom, tracked by Microsoft as Storm-0978. This Russian-based threat actor has been credited for utilising an exploit of this flaw to target political and government entities across Europe and North America, including those attending the recent NATO summit. Exploitation of this flaw occurs through a malicious Word document being sent to the victim via email or instant message. The victim needs to open this file in order for the attack to take place, so the attackers use sophisticated phishing methods to trick their victim into doing this. 

In the case of the RomCom exploits, the attackers impersonated the Ukrainian World Congress to encourage their victims to open the malicious documents. The files included in these phishing messages are able to avoid the Mark of the Web (MOTW) which is usually applied by Microsoft to all documents originating from the internet. As these files do not have MOTW tags, they bypass the security defences set up to check for malicious content. Once opened, these documents then execute commands that lead to further attacks such as installing ransomware on the target device. 

This new defense-in-depth update prevents the attack chain used in the exploitation of this Windows Search RCE vulnerability. Microsoft advise customers to install these Office updates alongside the Windows updates also released this week to ensure their devices are fully protected. A fix for another actively exploited zero-day flaw, CVE-2023-38180, is also included in the Microsoft patch Tuesday updates. This vulnerability occurs within the .NET application and Visual Studio. An exploit of this flaw could lead to denial-of-service attacks on the target system.