CVE-2023-36865
📋 TL;DR
This vulnerability allows remote code execution when a user opens a specially crafted Visio file. Attackers can exploit this to run arbitrary code with the privileges of the current user. All users running affected versions of Microsoft Visio are potentially vulnerable.
💻 Affected Systems
- Microsoft Office Visio
📦 What is this software?
365 Apps by Microsoft
Office by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the logged-in user, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malicious actor tricks user into opening a crafted Visio file, leading to malware installation, credential theft, or backdoor establishment on the victim's system.
If Mitigated
Limited impact with proper email filtering, user awareness training, and application sandboxing preventing successful exploitation.
🎯 Exploit Status
Requires user interaction (opening malicious file). No public exploit code available at time of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: July 2023 security updates
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36865
Restart Required: Yes
Instructions:
1. Open Microsoft Visio. 2. Go to File > Account > Update Options > Update Now. 3. Alternatively, use Windows Update to install the latest security updates. 4. Restart the system after installation.
🔧 Temporary Workarounds
Block Visio file attachments
allConfigure email gateways to block .vsd, .vsdx, and .vssx file attachments
Disable Visio in Office suite
windowsRemove or disable Visio application from affected systems if not required
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized executables from running
- Use Microsoft Office Protected View to open files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Visio version via File > Account > About Visio. If version is older than July 2023 updates, system is vulnerable.Check Version:
wmic product where name like "Microsoft Visio%" get versionVerify Fix Applied:
Verify Visio version is updated to July 2023 or later security update. Check Windows Update history for KB5028950 or later.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing Visio process spawning unexpected child processes
- Antivirus alerts for malicious Visio files
Network Indicators:
- Outbound connections from Visio process to unknown IPs
- DNS queries for suspicious domains from Office processes
SIEM Query:
process_name:"VISIO.EXE" AND (process_child_name:*.exe OR network_connection:*)