Security readout for executives and security teams
Plain-English summary
CVE-2022-44695 is a high-severity Microsoft Office Visio remote code execution vulnerability. Business risk is concentrated on user workstations where affected Office or Visio versions handle untrusted files. Successful exploitation could compromise confidentiality, integrity, and availability on the affected system.
Executive priority
Treat this as a standard high-priority endpoint patching issue. It is not marked as actively exploited in the provided sources, but the potential impact is full system compromise after user interaction.
Technical view
Microsoft describes this as an Office Visio remote code execution vulnerability. CVSS 3.1 is 7.8 with local attack vector, low complexity, no privileges required, and user interaction required. The listed impact is high for confidentiality, integrity, and availability.
Likely exposure
Potential exposure exists on endpoints running Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Office LTSC 2021, Visio 2013 SP1, or Visio 2016, especially where users open externally supplied Office or Visio content.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. CVSS marks exploit code maturity as unproven. Exploitation requires user interaction and a local attack context, so exposure depends heavily on endpoint patch status and document-handling workflows.
Researcher notes
The bundle provides limited technical detail beyond MSRC classification and CVSS. Avoid assuming a file format, exploit primitive, or attack campaign. Validation should focus on affected product inventory, patch state, and user-facing document intake paths.
Mitigation direction
- Apply Microsoft security updates for CVE-2022-44695 from the MSRC guidance.
- Prioritize endpoints with Visio or affected Office versions used for external documents.
- Check vendor guidance for any product-specific update requirements.
- Limit handling of untrusted Visio or Office files until affected systems are updated.
Validation and detection
- Inventory endpoints for the affected Microsoft Office and Visio products listed in the advisory.
- Confirm installed versions are updated according to Microsoft’s CVE-2022-44695 guidance.
- Verify Microsoft 365 Apps update channels have received the relevant security update.
- Review exposure for users who routinely receive external Visio or Office files.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-44695 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- Microsoft Office Visio Remote Code Execution VulnerabilityCVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.