Vulnerability Deep Dive - Ichitaro Office Excel File Code Execution Vulnerability
Summary: Cisco Talos discovered three vulnerabilities in JustSystems' Ichitaro Office suite, widely used in Japan, all of which lead to a state where arbitrary code can be executed, though Talos says it has no indication any were exploited in the wild. Talos detailed one flaw in which reading a Continue record (type 0x3c) subtracts one from a file-supplied value, causing an integer underflow that passes the copy function's size check, and combined with a TxO record and Windows 7 Low-Fragmentation Heap manipulation, overwrites a Row object's vtable to gain EIP and stack control.
Key Takeaway: The exploit was built for Ichitaro 2016 v0.3.2612 on Windows 7 and ends by dropping calc.exe into memory and calling WinExec - a full remote code execution chain from a single opened document, which is why Talos frames patching as vital.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026