CVE-2024-38189
Microsoft Project Remote Code Execution Vulnerability
Description
CVE-2024-38189 is a high-severity remote code execution vulnerability in Microsoft Project with a CVSS v3.1 base score of 8.8. The flaw enables an attacker to execute arbitrary code on a victim's system when the user opens a specially crafted Microsoft Project file. CISA has added CVE-2024-38189 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 3, 2024, and the ransomware association is classified as unknown. With an EPSS score of 43.66% at the 97.4th percentile, this vulnerability is heavily exploited in the wild. The vulnerability affects Microsoft 365 Apps, Office 2019, Office LTSC 2021, and Microsoft Project 2016.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | 365 apps | - |
| microsoft | office 2019 | - |
| microsoft | office long term servicing channel | 2021 |
| microsoft | project 2016 | < 16.0.5461.1001 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38189(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38189(US Government Resource)
Weakness Type
Remote Code Execution in Microsoft Project
CVE-2024-38189 is a remote code execution vulnerability in Microsoft Project, the project management application within the Microsoft Office suite. The vulnerability is triggered when a user opens a maliciously crafted Project file that exploits improper handling of embedded macros or content within the application. Microsoft Project processes complex file formats containing task definitions, resource allocations, timelines, and embedded objects. The vulnerability allows the crafted file to execute arbitrary code in the context of the user who opens it. Remote code execution through Office applications is a well-established attack vector because users routinely open files received from external sources, and the complex file format parsers in Office applications present a large attack surface for memory corruption and logic vulnerabilities.
Impact Analysis
The business impact of CVE-2024-38189 is severe across all three security dimensions. Confidentiality is fully compromised (C:H) because successful exploitation grants the attacker code execution with the permissions of the user who opened the malicious Project file. This enables access to all files, email, credentials, and network resources available to that user. Project managers who typically use Microsoft Project often have broad access to sensitive project data, financial information, and organizational planning documents.
Integrity faces maximum impact (I:H) as the attacker can install malware, modify documents, manipulate project data, and establish persistent backdoor access. The attacker can also use the compromised workstation as a pivot point to attack other systems on the network.
Availability is fully at risk (A:H) because arbitrary code execution enables ransomware deployment, data destruction, and resource hijacking. The network attack vector (AV:N) means malicious Project files can be delivered via email, shared drives, or web downloads. The low attack complexity (AC:L) indicates reliable exploitation, and while user interaction (UI:R) is required to open the file, social engineering through business-relevant project file naming is highly effective. The EPSS score of 43.66% at the 97.4th percentile confirms massive exploitation volumes, placing it among the most actively targeted Office application vulnerabilities.
Exploit Maturity
CVE-2024-38189 has reached high exploit maturity with confirmed widespread active exploitation. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of September 3, 2024. The EPSS score of 43.66% at the 97.4th percentile indicates that this is one of the most heavily exploited vulnerabilities in the current threat landscape.
Microsoft has confirmed exploitation in the wild through its security advisory. The exploitation typically involves delivering a crafted Microsoft Project file to the victim through phishing emails with business-relevant pretexts such as project proposals, timeline updates, or resource planning documents. The effectiveness of this attack vector is amplified because Microsoft Project files (.mpp) are less commonly subject to security scrutiny compared to Word or Excel files, and many organizations do not have specific file type blocking rules for Project files. The ransomware association is classified as unknown, but the reliable remote code execution capability makes it suitable for any post-exploitation objective.
Remediation
-
Apply the August 2024 Microsoft security updates immediately. Install the updates from the Microsoft Security Response Center advisory. For Microsoft 365 Apps and Office 2019, ensure automatic updates are enabled and current. For Project 2016, update to version 16.0.5461.1001 or later. For Office LTSC 2021, apply the latest cumulative update.
-
Block Microsoft Project files from untrusted sources. Configure email gateway policies to quarantine or strip Microsoft Project file attachments (.mpp, .mpt) from external senders. Implement download restrictions on web proxies for Project file types from untrusted sources. This significantly reduces the primary delivery mechanism for this exploit.
-
Enforce macro security policies for Microsoft Project. Ensure that VBA macro execution policies in Microsoft Project are configured to disable macros with notification or block all macros without notification. Apply the Group Policy setting to block macros in files from the internet, which prevents execution of VBA code in files with the Mark of the Web tag.
-
Enable Microsoft Defender Attack Surface Reduction rules. Activate ASR rules that prevent Office applications from creating child processes, injecting code into other processes, and creating executable content. These rules provide defense-in-depth against exploitation of Office application vulnerabilities including Microsoft Project.
-
Conduct targeted user awareness training. Educate users who work with Microsoft Project about the risk of opening Project files from untrusted or unexpected sources. Emphasize that legitimate project file exchanges should occur through approved collaboration platforms rather than direct email attachments.
Technical Details
CVE-2024-38189 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, resulting in a high base score of 8.8. The network attack vector (AV:N) reflects delivery of malicious Project files through email, web, or file sharing. The low attack complexity (AC:L) indicates reliable, repeatable exploitation without special conditions. No privileges (PR:N) are required on the target system, but user interaction (UI:R) is needed to open the crafted file.
The vulnerability exists in Microsoft Project's file parsing and macro execution components. When a user opens a specially crafted .mpp file, the application processes embedded content that triggers arbitrary code execution. The attack mechanism likely involves exploitation of VBA macro capabilities or embedded objects within the Project file format that bypass standard security controls. The file format parser in Microsoft Project handles complex data structures for tasks, resources, calendars, and dependencies, and flaws in this parsing logic can lead to memory corruption conditions exploitable for code execution. The scope is unchanged (S:U), and all three impact metrics are high, reflecting full compromise of the user's session and system access. Affected products include Microsoft 365 Apps (all current channels), Office 2019, Office LTSC 2021, and Microsoft Project 2016 (versions prior to 16.0.5461.1001).
Frequently Asked Questions
What is CVE-2024-38189?
CVE-2024-38189 is a high-severity remote code execution vulnerability in Microsoft Project that allows an attacker to execute arbitrary code when a user opens a malicious Project file. It has a CVSS v3.1 score of 8.8 and is actively exploited in the wild.
Which Microsoft Office products are affected by CVE-2024-38189?
The vulnerability affects Microsoft 365 Apps, Microsoft Office 2019, Office LTSC 2021, and Microsoft Project 2016 (versions before 16.0.5461.1001). All organizations using any of these products should apply the security update immediately.
Can CVE-2024-38189 be exploited without opening a file?
No, CVE-2024-38189 requires user interaction (UI:R), specifically opening a maliciously crafted Microsoft Project file. However, the low attack complexity and network delivery vector make social engineering through email attachments highly effective.
How can I protect against CVE-2024-38189 before patching?
Before patching, enforce macro security policies to disable VBA macros in Microsoft Project, block .mpp file attachments from external email senders, enable Microsoft Defender Attack Surface Reduction rules for Office applications, and educate users about the risks of opening unexpected Project files.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.