What’s Vulnerable › Vulnerabilities

CVE-2024-27674

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-03 · updated 2026-06-17
• Weakness: CWE-276

Description

Macro Expert through 4.9.4 allows BUILTIN\Users:(OI)(CI)(M) access to the "%PROGRAMFILES(X86)%\GrassSoft\Macro Expert" folder and thus an unprivileged user can escalate to SYSTEM by replacing the MacroService.exe binary.

Affected products

• Macro-Expert Macro Expert: through 4.9.4

References

• https://github.com/Alaatk/CVE-2024-27674/tree/main
• https://www.macro-expert.com/
• https://github.com/Alaatk/CVE-2024-27674/tree/main
• https://www.macro-expert.com/

Get alerted when CVE-2024-27674 or the next vulnerability affects your stack