CVE-2024-38226: Microsoft Publisher security feature bypass via local attacker

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is confirmed exploited in CISA KEV with a high CVSS of 7.3, but requires local access and user interaction, limiting mass exploitation.

What it is

CVE-2024-38226 is a security feature bypass in Microsoft Publisher, affecting Office 2019, Office Long Term Servicing Channel, and Publisher. The flaw lets an attacker defeat a protection mechanism, which matters because Microsoft and CISA both treat it as exploited in the wild. The record gives no detail on the specific protection bypassed or the vulnerable code path.

Impact

An attacker can bypass a Publisher security feature, gaining high confidentiality, integrity and availability impact on the local system. The exact actions enabled are not described in the record.

Attack surface

The CVSS vector is local (AV:L) with low privileges (PR:L) and required user interaction (UI:R), so an attacker needs local access and must convince a user to open or act on a crafted Publisher file. No remote or unauthenticated path is indicated.

Exploitation

CVE-2024-38226 is listed in CISA KEV with a due date of 2024-10-01, confirming known exploitation, though EPSS 30-day probability is low at 0.02667 (84.98th percentile). No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update for CVE-2024-38226 immediately; CISA's required action is to apply vendor mitigations or discontinue use of the product.
• If patching cannot be completed, restrict or block use of Microsoft Publisher and opening of untrusted Publisher files.
• Enforce least privilege so users do not operate with administrative rights, reducing the local attack surface.
• Block Publisher file attachments and downloads from external or untrusted sources at email and web gateways.
• Track KEV remediation to the 2024-10-01 due date and verify patch status across Office 2019 and LTSC installs.

Detection

• Monitor for Publisher (MSPUB.EXE) spawning unusual child processes or writing to sensitive locations.
• Alert on Publisher documents opened from email attachments, downloads or temporary directories.
• Audit endpoints for missing Microsoft Office updates matching CVE-2024-38226 and report unpatched hosts.
• Review process creation and file write telemetry around Publisher sessions for signs of protection bypass.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.