First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-36866

HighCVSS 7.8/10Last modified Aug 10, 2026

Description

Microsoft Office Visio Remote Code Execution Vulnerability

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Microsoft 365 Apps for Enterprise	>= 16.0.1, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office 2019	>= 19.0.0, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office LTSC 2021	>= 16.0.1, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Visio 2016	>= 16.0.1, < 5439.1000

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36866Patch, Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36866Patch, Vendor Advisory

Timeline

Published: Aug 8, 2023
Last modified: Aug 10, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-368677.8Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability CVE-2023-368686.5Azure Service Fabric on Windows Information Disclosure Vulnerability CVE-2023-368696.3Azure DevOps Server Spoofing Vulnerability CVE-2023-36879.8A vulnerability was found in Bylancer QuickVCard 2.1. It has been rated as critical. This issue affects some unknown processing of the file CVE-2023-368716.5Azure Active Directory Security Feature Bypass Vulnerability CVE-2023-368725.5VP9 Video Extensions Information Disclosure Vulnerability CVE-2023-368735.9.NET Framework Spoofing Vulnerability CVE-2023-368747.8Windows Error Reporting Service Elevation of Privilege Vulnerability CVE-2023-368767.1Reliability Analysis Metrics Calculation (RacTask) Elevation of Privilege Vulnerability CVE-2023-368774.5Azure Apache Oozie Spoofing Vulnerability CVE-2023-368784.3Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability CVE-2023-36889.8A vulnerability classified as critical has been found in Bylancer QuickJob 6.1. Affected is an unknown function of the component GET Paramet