Microsoft Office Spoofing Vulnerability Let Attackers Steal Sensitive Data

Microsoft disclosed CVE-2024-38200, a spoofing vulnerability (CVSS 7.5) affecting Office 2016, Office 2019, Office LTSC 2021 and Microsoft 365 Apps (32/64-bit) that could allow exposure of sensitive information via specially crafted files delivered through malicious or compromised websites; Microsoft assesses active exploitation as "less likely". The company deployed an interim fix via Feature Flighting on July 30, 2024 and plans a formal patch on August 13, 2024; recommended mitigations include restricting NTLM traffic, placing high-value accounts in the Protected Users group, and blocking outbound TCP 445.