CVE-2019-1297
Microsoft Excel Remote Code Execution Vulnerability
Description
CVE-2019-1297 is a high-severity remote code execution vulnerability affecting Microsoft Excel. A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 30.84% (96.7th percentile), this vulnerability has a notable probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | excel | 2010; 2013; 2016 |
| microsoft | office | 2016; 2019 |
| microsoft | office 365 proplus | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1297(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1297(US Government Resource)
Weakness Type
Unspecified Weakness
No specific CWE has been assigned to this vulnerability. The underlying weakness type is not publicly categorized, but the vulnerability's impact is well-documented through its inclusion in the CISA KEV catalog.
Impact Analysis
CVE-2019-1297 carries a CVSS 3.1 score of 8.8 (HIGH), indicating a high-severity threat. The vulnerability is exploitable over the network with low attack complexity and requires no authentication, though user interaction is needed. Successful exploitation can severely compromise data confidentiality, and allow unauthorized modification of data and systems, and cause complete service disruption. Organizations running affected Excel deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2019-1297 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 30.84% (96.7th percentile) indicates a significant probability of exploitation. Federal agencies were required to remediate this vulnerability by 2022-03-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (microsoft excel 2010; 2013; 2016; microsoft office 2016; 2019; microsoft office 365 proplus -) have been updated to patched versions.
- If immediate patching is not possible, restrict network access to affected systems using firewall rules and network segmentation to limit exposure.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2019-1297 affects Microsoft Excel. A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory. The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely without physical access to the target system. The CVSS score of 8.8 reflects a serious vulnerability that poses meaningful risk to affected environments.
Frequently Asked Questions
Is CVE-2019-1297 being actively exploited?
Yes. CVE-2019-1297 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 30.84% (96.7th percentile) further indicates a significant exploitation probability.
What products are affected by CVE-2019-1297?
CVE-2019-1297 affects Microsoft Excel. Specifically affected products include: microsoft excel (2010; 2013; 2016), microsoft office (2016; 2019), microsoft office 365 proplus (-).
How do I fix CVE-2019-1297?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure.
How severe is CVE-2019-1297?
CVE-2019-1297 has a CVSS 3.1 score of 8.8 (HIGH). This is a high-severity vulnerability that should be prioritized for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.