When Visio is opened by an attacker and the default settings are used, Visio will run commands on the remote host.
CVE-2019-1553 is a remote code execution vulnerability in the parsing engine of Visio. When an attacker opens an malicious Visio document, it can run malicious code on the remote host.
CVE-2019-1774 is a remote code execution vulnerability in the rendering engine of Visio. When an attacker opens an malicious Visio document, it can run malicious code on the remote host.
CVE-2019-1775 is a remote code execution vulnerability in the parsing engine of Visio. When an attacker opens an malicious Visio document, it can run malicious code on the remote host.
It can be exploited when an attacker sends a malicious Visio document to the target.
How do you know if you’re affected?
If you are using Visio, we recommend that you update to the latest version of Visio as soon as possible.
How do I know if I’m vulnerable?
Visio is vulnerable to these three vulnerabilities if it is running on the localhost or if the default settings are used when opening a document.
Vulnerable Versions
Visio 2016 Service Pack 1 and Visio 2017 Service Pack 3.
Timeline
Published on: 09/13/2022 19:15:00 UTC
Last modified on: 09/16/2022 17:34:00 UTC