CVE-2024-38226
Microsoft Publisher Protection Mechanism Failure Vulnerability
Description
CVE-2024-38226 is a high-severity security feature bypass vulnerability in Microsoft Publisher that affects Office 2019, Office LTSC 2021, and Publisher 2016. The flaw allows an authenticated local attacker to bypass macro security policies in Publisher, enabling the execution of malicious macros without triggering the standard security warnings that users depend on for protection. With an EPSS score of 1.4% (80.4th percentile) and confirmed active exploitation, CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 1, 2024. Organizations using Microsoft Publisher should prioritize applying the September 2024 security updates.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office 2019 | - |
| microsoft | office long term servicing channel | 2021 |
| microsoft | publisher | 2016 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38226(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38226(US Government Resource)
Weakness Type
Security Feature Bypass in Macro Policy Enforcement
Although no formal CWE has been assigned to CVE-2024-38226, the vulnerability represents a security feature bypass targeting Microsoft Publisher's macro security controls. Office applications implement macro security policies — including trust settings, digital signature requirements, and the VBA macro block for internet-sourced documents — to prevent execution of potentially malicious macros. This vulnerability circumvents those enforcement mechanisms, allowing untrusted macros to execute without user consent or warning. Security feature bypasses in Office macro handling are particularly dangerous because macros remain one of the most prevalent malware delivery mechanisms in enterprise environments.
Learn more: CWE-693: Protection Mechanism Failure
Impact Analysis
The CVSS v3.1 base score of 7.3 (High) reflects a serious bypass of security controls with substantial impact. Confidentiality (C:H) and integrity (I:H) are both fully compromised, meaning a successfully executed malicious macro can exfiltrate sensitive data and modify files or system configurations. Availability (A:H) is also fully impacted, as macros can terminate processes, corrupt files, or render the system unusable. The attack requires local access with low privileges and user interaction (the victim must open a malicious Publisher document), which limits the attack surface but aligns with common phishing delivery scenarios.
From a business perspective, macro-based attacks remain the most popular initial access technique for threat actors targeting enterprises. Microsoft's macro security policies are a critical defensive layer, and bypassing them effectively removes the user's ability to make informed decisions about whether to trust a document. An attacker can deliver a crafted Publisher file via email that, when opened, executes macros without triggering any security dialog or Protected View warning. The EPSS score of 1.4% at the 80.4th percentile indicates above-average exploitation activity. While the ransomware association is listed as unknown, macro-based document delivery has historically been one of the most common vectors for ransomware distribution.
Exploit Maturity
CVE-2024-38226 has been confirmed as actively exploited in the wild, resulting in its addition to CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 1, 2024. The EPSS probability of 1.4% at the 80.4th percentile indicates elevated exploitation activity above the baseline for most tracked vulnerabilities. Microsoft's official security advisory confirms the vulnerability and provides patch information as part of the September 2024 Patch Tuesday release.
The ransomware usage status is classified as "Unknown," but the nature of this vulnerability — bypassing macro security in an Office application — closely aligns with known ransomware delivery techniques. Threat groups such as Emotet, QakBot, and various ransomware-as-a-service (RaaS) affiliates have extensively used Office macro-based delivery in their campaigns. While Microsoft Publisher is less commonly targeted than Word or Excel, the bypass itself may indicate a trend toward exploiting less-scrutinized Office applications where security controls receive fewer defensive layers. The combination of active exploitation and KEV listing makes this a priority for immediate patching.
Remediation
- Apply September 2024 security updates — Install the latest patches for Microsoft Office 2019, Office LTSC 2021, and Publisher 2016 as documented in the Microsoft Security Advisory. Use Windows Update, WSUS, or Microsoft Configuration Manager for enterprise-wide deployment.
- Enforce macro blocking via Group Policy — Configure "Block macros from running in Office files from the Internet" policy for Publisher in addition to Word, Excel, and PowerPoint. Ensure the policy is applied at the organizational level through Active Directory Group Policy Objects.
- Restrict Publisher file delivery — Add .pub file extensions to your email gateway's blocked or quarantined attachment list. Most organizations rarely require Publisher files in email communications, making this a low-impact security improvement.
- Implement application control policies — Deploy Windows Defender Application Control (WDAC) or AppLocker rules that prevent VBA macro execution from untrusted Publisher documents. Restrict which applications are permitted to spawn child processes such as PowerShell or cmd.exe.
- Educate users about Publisher-based phishing — Update security awareness training to include examples of attacks using Publisher documents. Emphasize that the absence of security warnings does not guarantee a document is safe, and encourage users to report any unexpected Publisher files received via email.
Technical Details
The CVSS v3.1 vector for CVE-2024-38226 is CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, yielding a base score of 7.3 (High). Attack Vector (AV:L) indicates the attack requires local execution context, typically achieved by having the victim open a malicious file. Attack Complexity (AC:L) means no special preconditions are needed. Privileges Required (PR:L) indicates a standard user account is sufficient. User Interaction (UI:R) requires the victim to open a crafted Publisher document. Scope (S:U) limits impact to the vulnerable component. Confidentiality (C:H), Integrity (I:H), and Availability (A:H) all reflect full compromise once malicious macro code executes.
The vulnerability specifically targets Microsoft Publisher's macro security enforcement mechanism. Under normal conditions, Publisher honors organizational macro policies (set via Group Policy or Trust Center settings) that block or prompt before executing VBA macros in documents from untrusted sources. CVE-2024-38226 circumvents this enforcement layer, allowing macros to execute silently without displaying the standard security bar or trust dialog. The attack scenario involves an attacker creating a Publisher document (.pub) containing malicious VBA macro code, then delivering it to the victim via email or another file transfer mechanism. When the victim opens the document, the macros execute with the privileges of the user's session, bypassing the security controls that would normally block or warn about untrusted macro content.
Frequently Asked Questions
What is CVE-2024-38226?
CVE-2024-38226 is a security feature bypass vulnerability in Microsoft Publisher that allows macros to execute without triggering the standard security warnings or honoring macro blocking policies. This means a malicious Publisher document can run harmful macro code silently when opened by an unsuspecting user.
Which versions of Microsoft Office are affected?
The vulnerability affects Microsoft Office 2019, Office Long Term Servicing Channel (LTSC) 2021, and the standalone Microsoft Publisher 2016. Organizations running any of these versions should apply the September 2024 security updates immediately.
How would an attacker exploit CVE-2024-38226?
An attacker would craft a malicious Publisher document (.pub file) containing VBA macro code and deliver it to the victim, typically via a phishing email. When the victim opens the document, the macros execute without displaying any security warnings, allowing the attacker to run arbitrary code within the user's session.
Should I block Publisher files at the email gateway?
Yes, blocking or quarantining .pub file attachments at the email gateway is a highly effective mitigation. Most organizations do not regularly exchange Publisher files via email, so the business impact is minimal while significantly reducing the attack surface for this and similar Publisher-based vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.