# MA-1120.082024: MyCERT Advisory - Microsoft Warns of Unpatched Office Vulnerability Leading to Data Exposure

**Date:** 11 Aug 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1120.082024  
**Advisory ID:** MA-1120.082024

---

**1.0 Introduction**
Recently, Microsoft issued a security advisory regarding a newly discovered zero-day vulnerability in its Office suite, specifically impacting Office 2016, Office 2019, Office LTSC 2021, and Microsoft 365 Apps for Enterprise. This vulnerability, identified as **CVE-2024-38200**, stems from an information disclosure flaw that allows attackers to steal NTLM (NT LAN Manager) hashes from users’ machines. The exposure of these hashes can lead to further network-based attacks, including NTLM relay attacks, potentially compromising critical systems within an organization. As of the latest update, no patch has been released, and the vulnerability remains unpatched.
**2.0 Impact**
The impact of CVE-2024-38200 is significant, with potential consequences including:
- **Credential Theft**: Attackers can extract NTLM hashes, which can be used to authenticate within the same network, leading to unauthorized access.
- **Network Exploitation**: The stolen NTLM hashes can be leveraged in NTLM relay attacks to gain access to additional network resources, enabling attackers to escalate privileges and compromise sensitive systems.
- **Data Breaches**: If exploited, the vulnerability could lead to the unauthorized access of confidential information, posing a serious risk to personal, corporate, and government data.
**3.0 Affected Systems**
The systems affected by this vulnerability include:
- **Microsoft Office 2016** (32-bit and 64-bit)
- **Microsoft Office 2019** (32-bit and 64-bit)
- **Microsoft Office LTSC 2021** (32-bit and 64-bit)
- **Microsoft 365 Apps for Enterprise** (32-bit and 64-bit)
**4.0 Recommendation**
CyberSecurity Malaysia encourages users and administrators to review [Microsoft security updates](https://msrc.microsoft.com/update-guide/) for more information and apply the necessary updates.
Kindly refer to the following URLs for more information:
- <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38200>
Generally, we advise the users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 08:30 -17:30 MYT 
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <https://thehackernews.com/2024/08/microsoft-warns-of-unpatched-office.html>
- <https://www.bleepingcomputer.com/news/security/microsoft-discloses-unpatched-office-flaw-that-exposes-ntlm-hashes/>
- <https://vulnera.com/newswire/unpatched-office-zero-day-vulnerability-disclosed-by-microsoft/>