Microsoft Project Remote Code Execution Vulnerability Advisory (CVE-2024-38189, CISA KEV Listed)
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft Project 2016, LTSC Professional Plus 2021, and Microsoft 365 Apps for Enterprise
Successful exploitation allows an attacker to execute arbitrary code with the privileges of the active user by tricking them into opening a specially crafted Project (.mpp) file
Apply the official Microsoft security updates immediately and enforce strict policies to block untrusted macro and external content execution
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Deploy the latest security updates provided by Microsoft. In enterprise environments, administrators can force the Office Click-to-Run service to pull and apply the latest patches using the following PowerShell command:
# Force Microsoft Office Click-to-Run update and patch application
Start-Process -FilePath 'C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe' -ArgumentList '/update user displaylevel=trueforceappshutdown=true' -Wait2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict the execution of untrusted macros and external content from internet-facing Project files via registry hardening:
# Block macro and external content execution for Project files originating from the Internet
New-ItemProperty -Path 'HKCU:\Software\Policies\Microsoft\Office\16.0\project\security' -Name 'blockcontentexecutionfrominternet' -PropertyType DWord -Value 1 -Force3. Log Audit & IoC Verification Commands
Use the following PowerShell script to audit the installed Microsoft Project version and verify if the system is running a vulnerable build:
# Audit installed Microsoft Office/Project versions and display build details
$OfficePath = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -like '*Microsoft * 20*' -or $_.DisplayName -like '*Microsoft 365*' }
foreach ($app in $OfficePath) {
[PSCustomObject]@{
'DisplayName' = $app.DisplayName
'DisplayVersion' = $app.DisplayVersion
'InstallDate' = $app.InstallDate
}
}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
CVE-2024-38189 is a critical Remote Code Execution (RCE) vulnerability in Microsoft Project. The root cause lies in improper input validation (CWE-20) during the parsing of Microsoft Project (.mpp) files. This flaw allows an attacker to craft a malicious file that triggers memory corruption or unexpected control flow redirection when processed by the application.
2. Exploitation Mechanics & Attack Scenario
An attacker delivers a weaponized Project file via phishing emails, malicious links, or compromised network shares. Since the vulnerability requires user interaction, social engineering is typically employed to entice the victim to open the file. Once opened, the malicious payload executes within the security context of the logged-in user, bypassing standard security warnings and establishing initial access. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.
3. Infrastructure & Business Impact
If successfully exploited, the attacker gains full control over the victim's workstation. This can lead to lateral movement within the corporate network, exfiltration of sensitive intellectual property, or deployment of ransomware. For organizations with privileged users (e.g., domain administrators) handling project management files, this poses an existential threat to the entire active directory domain.
Official Vendor Advisories & References
Microsoft Project Remote Code Execution Vulnerability
Frequently Asked SecOps Questions (CVE-2024-38189)
FAQQ1. How critical is CVE-2024-38189 and is it actively exploited in the wild?
CVE-2024-38189 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 8.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-38189?
Primary impacted vendors include microsoft across project. Scope summary: All supported versions of Microsoft Project, including Project 2016, Project LTSC 2021, and Microsoft 365 Apps for Enterprise
Q3. What temporary mitigations or workarounds exist for CVE-2024-38189 before patching?
[Mitigation] Apply the official Microsoft security updates immediately and enforce strict policies to block untrusted macro and external content execution Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-38189
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Microsoft Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) Urgent Security Advisory
[Affected Scope] Windows Shell component across Microsoft Windows operating systems
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.