PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-24509 Microsoft CVE debrief

A remote code execution vulnerability in Microsoft Office Visio allows an attacker to execute arbitrary code if a user opens a specially crafted file. The vulnerability requires user interaction—typically opening a malicious Visio document. With a CVSS 3.1 score of 7.8 (HIGH), successful exploitation grants high impact across confidentiality, integrity, and availability. The attack vector is local (AV:L), requiring the victim to open a file, with low attack complexity (AC:L) and no privileges required (PR:N), though user interaction is necessary (UI:R). The scope is unchanged (S:U). Microsoft addressed this vulnerability in March 2022 security updates. The CVE record was modified in May 2026, indicating ongoing curation of metadata. No known exploitation in ransomware campaigns has been documented (CISA KEV: not listed).

Vendor
Microsoft
Product
Microsoft Office 2019
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2022-03-09
Original CVE updated
2026-05-19
Advisory published
2022-03-09
Advisory updated
2026-05-19

Who should care

Organizations running Microsoft Office Visio in enterprise environments, particularly those with users who regularly receive external documents. Security teams responsible for endpoint protection, patch management, and Microsoft 365 security configuration. Incident response teams monitoring for Office-based exploitation patterns.

Technical summary

CVE-2022-24509 is a remote code execution vulnerability in Microsoft Office Visio. Exploitation requires a victim to open a maliciously crafted Visio file, after which the attacker can execute code in the context of the current user. The vulnerability is rated HIGH (CVSS 7.8) due to the potential for complete system compromise if exploited. Microsoft released patches in March 2022. The vulnerability affects Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021. No public ransomware exploitation has been confirmed. Defensive measures center on patching, attack surface reduction, and user awareness.

Defensive priority

HIGH

Recommended defensive actions

  • Apply Microsoft security updates from March 2022 Patch Tuesday to all affected Office/Visio installations.
  • Verify Visio file handling restrictions via Microsoft Defender Attack Surface Reduction (ASR) rules, particularly rules blocking Office apps from creating child processes or blocking executable content from email client.
  • Enable Protected View for all files originating from the Internet or untrusted locations.
  • Deploy application control policies (AppLocker/WDAC) to restrict execution of untrusted code from Office application contexts.
  • Conduct user awareness training on recognizing suspicious Visio files and social engineering lures.
  • Monitor for anomalous child process creation from VISIO.EXE as potential exploitation indicator.

Evidence notes

CVE published 2022-03-09; modified 2026-05-19. CVSS 3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Affected products per NVD CPE: Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021. No CISA KEV entry. Microsoft Security Response Center guidance available.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-24509 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-24509

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-24509 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-24509

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.