#rce

**Is the Preview Pane an attack vector for this vulnerability?** Yes, the Preview Pane is an attack vector.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.

Use after free in Desktop Windows Manager allows an authorized attacker to execute code locally.

**How could an attacker exploit this vulnerability?** An attacker authenticated on the domain could exploit this vulnerability by tricking a domain-joined user into sending a request to a malicious server via the Routing and Remote Access Service (RRAS) Snap-in. This could result in the server returning malicious data that might cause arbitrary code execution on the user's system.

**How could an attacker exploit the vulnerability?** To exploit this vulnerability, an authenticated attacker would need to send a specially crafted MSMQ packet to a MSMQ server. This could result in remote code execution on the server side.

**How could an attacker exploit the vulnerability?** To exploit this vulnerability, an authenticated attacker would need to send a specially crafted MSMQ packet to a MSMQ server. This could result in remote code execution on the server side.

Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network.

**According to the CVSS metric, attack vector is (AV:N) and user interaction is none (UI:N). What does that mean for this vulnerability?** This can happen without user intervention. An attacker can use an uninitialized function pointer being called when decoding a JPEG image. This can be embedded in Office and 3rd party documents/files