CVE-2024-38226

What it actually does

CVE-2024-38226 is a Microsoft Publisher security feature bypass that allows a specially crafted Publisher document to evade Microsoft Office protections intended to block untrusted or malicious macro-enabled content. Exploitation requires user interaction: a victim must open the crafted Publisher file in a vulnerable version of Microsoft Publisher. Successful exploitation does not directly provide remote code execution by itself, but it can remove or bypass a key safety control, allowing malicious macros or active content to run where policy would normally prevent execution.

Why it matters to the business

This vulnerability enables phishing-based malware delivery through Microsoft Publisher files by weakening Office macro protections that many organizations rely on to stop initial compromise. Because it is listed in CISA KEV, has active in-the-wild exploitation, and had a remediation deadline of 2024-10-01, unpatched systems should be treated as urgent exposure. Business consequences include endpoint compromise, credential theft, malware installation, lateral movement, and potential disruption if the bypass is used as part of a broader intrusion chain.

How an attack unfolds

An attacker prepares a malicious Microsoft Publisher document designed to trigger the security feature bypass. The document is delivered to a target through phishing email, file-sharing links, compromised websites, or other social-engineering channels. When a user opens the file with a vulnerable Publisher installation, the document bypasses Office macro protections that would normally block untrusted active content. The malicious content can then execute follow-on commands, such as launching PowerShell, Windows Script Host, mshta, rundll32, regsvr32, or other living-off-the-land tools to download and run payloads. From there, the attacker may establish persistence, steal credentials, perform reconnaissance, and move laterally depending on the payload used. No named threat actor attribution is provided, but KEV status confirms real-world exploitation has been observed.

How to fix it

Apply the Microsoft security updates that address CVE-2024-38226 for Microsoft Publisher / Microsoft Office. Systems should be updated to the September 2024 Microsoft security update level or later, including supported Microsoft 365 Apps update channels and supported perpetual Office installations. If immediate patching is not possible, reduce exposure by blocking or quarantining Publisher attachments from untrusted sources, disabling or removing Microsoft Publisher where it is not business-critical, enforcing Attack Surface Reduction rules for Office child-process creation and executable content, blocking macros from the internet, and restricting script interpreters and living-off-the-land binaries from being launched by Office applications.

How to confirm the fix worked

Confirm that Microsoft Publisher and Office installations report a build level that includes the September 2024 security fixes or later. Use enterprise patch management, Microsoft 365 Apps admin inventory, endpoint management, or vulnerability scanning to verify that all Publisher-capable Office installations are updated. Validate compensating controls by confirming that Publisher files from the internet retain Mark-of-the-Web metadata, that macros from untrusted locations are blocked, and that Office applications are prevented from spawning scripting or command-line interpreters where ASR or EDR policy is available. Review whether Microsoft Publisher is installed on systems where it is not required and remove it to reduce attack surface.

Typical attack path

1. Attacker creates a specially crafted Microsoft Publisher document, commonly distributed as a .pub file.
2. Attacker delivers the document through phishing, file-sharing services, or a malicious download link.
3. User opens the document in a vulnerable Microsoft Publisher installation.
4. The document bypasses Office macro or untrusted-content protections.
5. Malicious macro or active content executes despite controls that should have blocked it.
6. The document launches a child process such as PowerShell, cmd.exe, wscript.exe, mshta.exe, rundll32.exe, or regsvr32.exe.
7. Follow-on payloads are downloaded, decoded, or executed on the endpoint.
8. Attacker establishes persistence, steals data or credentials, and attempts lateral movement if the payload supports it.

How to detect it

To determine whether this was already exploited, focus on evidence of Microsoft Publisher opening untrusted documents and then launching suspicious child processes or creating executable/script files. Review EDR and Sysmon process creation events, especially Event ID 1, Windows Security 4688 process creation logs, Microsoft Defender for Endpoint device process events, Office telemetry, email gateway attachment logs, Exchange / Microsoft 365 message trace, web proxy downloads, and file creation events in user download and temporary directories. Look for MSPUB.EXE followed by powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, or encoded command lines. Correlate these events with recently received .pub attachments, files opened from Downloads, Outlook cache, Teams/SharePoint sync locations, browser cache, or temporary directories. Also inspect for macro execution, dropped payloads, persistence changes, scheduled tasks, Run keys, startup folder entries, and outbound connections immediately after Publisher execution.

• MSPUB.EXE
• *.pub
• ParentImage=*\MSPUB.EXE Image=*\powershell.exe
• ParentImage=*\MSPUB.EXE Image=*\cmd.exe
• ParentImage=*\MSPUB.EXE Image=*\wscript.exe
• ParentImage=*\MSPUB.EXE Image=*\cscript.exe
• ParentImage=*\MSPUB.EXE Image=*\mshta.exe
• ParentImage=*\MSPUB.EXE Image=*\rundll32.exe
• ParentImage=*\MSPUB.EXE Image=*\regsvr32.exe
• ParentImage=*\MSPUB.EXE Image=*\certutil.exe
• ParentImage=*\MSPUB.EXE Image=*\bitsadmin.exe
• ParentImage=*\MSPUB.EXE Image=*\curl.exe
• ParentImage=*\MSPUB.EXE Image=*\schtasks.exe
• ParentImage=*\MSPUB.EXE Image=*\wmic.exe
• powershell.exe -EncodedCommand
• powershell.exe -enc
• powershell.exe -ExecutionPolicy Bypass
• mshta.exe http
• regsvr32.exe /s /n /u /i:http
• rundll32.exe javascript:
• %TEMP%\*.ps1
• %TEMP%\*.vbs
• %TEMP%\*.js
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• HKLM\Software\Microsoft\Windows\CurrentVersion\Run

What your security team should do

• Treat unpatched Microsoft Publisher installations as high priority because the vulnerability is in CISA KEV and exploitation has been observed in the wild.
• Patch Microsoft Publisher / Office to the September 2024 security update level or later across all supported update channels.
• Identify endpoints with Microsoft Publisher installed and remove it where there is no business requirement.
• Block or heavily scrutinize inbound .pub attachments and Publisher files downloaded from the internet.
• Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and executable content.
• Hunt for Publisher spawning script interpreters, command shells, or LOLBins, especially around email-delivered or downloaded .pub files.
• Review email, web proxy, EDR, and endpoint telemetry for Publisher documents opened shortly before suspicious process execution.
• Educate users and help desks that Publisher documents are a plausible malware delivery format, not just Word or Excel documents.