CVE-2024-38189: Microsoft Project Remote Code Execution via Improper Input Validation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityThe vulnerability is in CISA's KEV catalog, indicating active exploitation, and allows remote code execution with high impact.

What it is

Microsoft Project and related Office products contain a remote code execution flaw rooted in improper input validation. An attacker can trigger code execution on a victim's system, and the vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, so it is being exploited in the wild.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the victim's user, potentially leading to full system compromise. The CVSS vector shows high confidentiality, integrity, and availability impact.

Attack surface

The flaw is network-reachable (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), typically opening a malicious file or link. No authentication is needed to deliver the attack.

Exploitation

CISA added this CVE to the KEV catalog on 2024-08-13 with a remediation due date of 2024-09-03, confirming active exploitation. EPSS gives a 30-day exploitation probability of about 8.2% (94.6th percentile), and no ransomware campaign use is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory immediately.
• If patching is not possible, follow CISA's guidance to discontinue use of the affected product or apply vendor-provided mitigations.
• Block or restrict opening untrusted Project files and links from external sources.
• Enable Protected View and other Office hardening features for Project documents.
• Monitor for and restrict execution of Project files from email and web downloads.

Detection

• Hunt for Project file executions spawning child processes such as cmd.exe, powershell.exe, or wscript.exe.
• Monitor for unusual network connections originating from Project or Office processes.
• Review endpoint logs for Project documents opened from temporary internet or email attachment directories.
• Alert on creation of suspicious files or registry changes following Project document opens.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.