CVE-2022-41107

A remote-code-execution flaw in Microsoft Office's graphics handling: a maliciously crafted file, once opened, can run code in the context of the user. The vector is local with required user interaction, which in Office-speak means the classic path, a document arrives, someone opens it, and the graphics parser is the trigger. No privileges are needed on the attacker's side beyond getting the file in front of a victim.

This is phishing-shaped, and Office file RCE is a perennial favorite of both commodity crews and targeted actors because the delivery, an email with an attachment, is so well understood. The gate is genuine, the user has to open the document, but attacker tradecraft around exactly that has been refined for decades, so the interaction requirement slows exploitation without preventing it. Weaponized documents for a bug like this can circulate quietly.

Our focus is patch coverage across the Office and Microsoft 365 Apps estate, since these ship on nearly every endpoint, plus the layered controls that catch the delivery: attachment filtering, Protected View, and endpoint detection watching for Office spawning child processes. We would rank it a solid priority in the monthly cycle, not a drop-everything emergency, because the user-interaction step gives our other defenses a place to intervene.