CVE-2024-30040

What is the Windows MSHTML Platform OLE/COM Security Feature?

MSHTML (Trident) is the Windows HTML rendering engine, historically used by Internet Explorer and still present as a system component. Modern versions of Windows include OLE (Object Linking and Embedding) security controls that are designed to restrict how embedded objects in documents — such as ActiveX controls, COM objects, and media files — are loaded and executed. These mitigations were introduced to block document-based phishing attacks that deliver malicious OLE objects, requiring user warnings before content from the internet is rendered in Office or MSHTML contexts. CVE-2024-30040 bypasses these OLE object protections in Microsoft 365 and Office.

Overview

CVE-2024-30040 is a zero-day security feature bypass in the Windows MSHTML Platform that disables OLE mitigations in Microsoft 365 and Office 2019/2021, allowing a malicious document to execute code when opened by a victim — without displaying the security warnings that would normally prompt the user. Microsoft and CISA simultaneously disclosed and patched this as a zero-day on May 14, 2024 (May Patch Tuesday), confirming active exploitation in spear-phishing campaigns.

Affected Versions

Technical Details

CWE-20 (Improper Input Validation). The MSHTML platform's OLE security feature bypass involves a failure to properly validate or enforce access restrictions on OLE/COM object instantiation in certain document processing contexts. When a user opens a malicious Office or HTML document, MSHTML processes embedded OLE content without applying the expected security checks — either skipping the check entirely or failing to block the object based on its origin or type. The result is silent execution of embedded OLE objects (such as custom ActiveX controls or COM automation objects) that would normally be blocked by Protected View or OLE security warnings.

Once an OLE object executes without warnings, an attacker can: download and execute additional payloads, establish persistence, exfiltrate data, and perform lateral movement — all with the privileges of the document-opening user, without any security prompt that might alert or allow the victim to cancel.

The CVSS score of 8.8 with User Interaction Required (UI:R) reflects that the victim must open the document, but no authentication is required and the attack complexity is Low once the victim is engaged via phishing.

Discovery

Confirmed as a zero-day by Microsoft's simultaneous Patch Tuesday disclosure and CISA KEV addition. No specific researcher attribution was included at disclosure, consistent with exploitation being discovered through incident response rather than bug bounty submission.

Exploitation Context

OLE/COM security feature bypass zero-days are a staple of APT and cybercrime phishing campaigns because they eliminate the security warnings that user awareness training teaches employees to recognize. When a "click here, click Enable, click Run" prompt is removed, document-based code execution becomes a single-click attack. This is the primary delivery mechanism for initial access in targeted spear-phishing operations against enterprise, government, and defense contractor targets. The simultaneous Patch Tuesday + CISA KEV combination indicates the attackers had exploited this window before Microsoft identified the bypass internally.

Remediation

1. Apply the May 2024 Microsoft security updates (Patch Tuesday, May 14, 2024) to all Windows systems and Office/Microsoft 365 installations.
2. Enable and enforce Protected View for files from the internet and email attachments in Office Group Policy — even after patching, Protected View provides defense-in-depth against future document-based exploits.
3. Configure Attack Surface Reduction (ASR) rules, particularly rules that block Office applications from creating child processes and block Office from injecting code into other processes.
4. Deploy Microsoft Defender Application Guard for Office to open untrusted documents in an isolated container environment.
5. Train users to be suspicious of any Office document that prompts for elevated permissions or displays unexpected security dialogs when opened.