CVE-2019-1297

CVE-2019-1297 is a remote code execution vulnerability in Microsoft Excel caused by the software failing to properly handle objects in memory. An attacker triggers it by persuading a user to open a specially crafted spreadsheet, for example an emailed attachment or a file downloaded from a malicious link, so user interaction is required. Successful exploitation lets the attacker execute arbitrary code in the context of the current user, gaining the privileges of that account rather than automatic system-level access. Anyone running an affected version of Excel at the time of disclosure is affected, with organizational risk concentrated on endpoints where users open untrusted spreadsheets. The flaw is known to be exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03, and EPSS assigns a roughly 22% probability of exploitation within 30 days (97th percentile), while no public proof-of-concept or confirmed ransomware linkage is documented.

What to do: Apply Microsoft's security updates for Excel/Office (2019 Patch Tuesday cycle or any later cumulative Office update) via Microsoft Update and verify installed Office build numbers against the Microsoft advisory. Until patched, train users not to open spreadsheets from untrusted sources and rely on Office Protected View for internet-sourced files, and hunt endpoints for exploitation indicators given the KEV listing.