---
title: "Microsoft Project CVE-2024-38189: Exploited File RCE"
url: https://erroneo.us/security/briefs/microsoft-project-cve-2024-38189-macro-rce/
description: "Exploited Project RCE runs code from a malicious file where internet macros are allowed. Fixed Aug 2024 (KB5002561, M365 builds). Check builds and macro policy."
type: security-brief
section: "Security Digest"
date_published: 2024-08-13
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-38189"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Microsoft Project CVE-2024-38189: Exploited File RCE

**Verdict: Check exposure.** Project installs updated since August 2024 with Microsoft's default macro settings are fine; the exposure left is Project 2016 or frozen Office builds that missed the update, and any Project user whose policy lets internet files run macros.

- **Who must act:** Organizations with Project desktop users where the internet-macro block is disabled by policy, or where Project 2016 (MSI), Office 2019 or Office LTSC 2021 builds predate August 13, 2024.
- **Who can relax:** Organizations with no Project desktop installs, and fleets on current Office builds that keep Microsoft's default block on macros in files from the internet.
- **Affected:** Microsoft 365 Apps for Enterprise before the August 13, 2024 builds (e.g., Current Channel 2407 before 17830.20166); Office 2019 and Office LTSC 2021 (Click-to-Run) before the August 13, 2024 builds; Project 2016 (MSI) before KB5002561
- **Fixed:** Current Channel 2407: build 17830.20166; Monthly Enterprise Channel 2406: 17726.20206; 2405: 17628.20206; Semi-Annual Enterprise Channel 2402: 17328.20550; 2308: 16731.20792; 2302: 16130.21094; Office LTSC 2021 volume licensed: 2108 build 14332.20763; Office 2019 volume licensed: 1808 build 10413.20020; Office 2016/2019/2021 retail: 2407 build 17830.20166; Project 2016 (MSI): KB5002561 (Winproj.exe 16.0.5461.1001)
- **CVEs:** CVE-2024-38189
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every machine with the Project desktop app and record its Office channel and build, or the Project 2016 file version.
2. Bring Click-to-Run Office to a current build and install KB5002561 or a later Project 2016 update on MSI installs.
3. Enable 'Block macros from running in Office files from the Internet' for Project and remove any policy that disables it.
4. Where that policy must stay off, enable 'VBA Macro Notification Settings' for Project with 'Disable all except digitally signed macros'.
5. Flag or quarantine Project (.mpp) attachments from outside senders at the mail gateway.

### How to check if you are affected

- Hunt in EDR for WINPROJ.EXE spawning cmd.exe, powershell.exe, wscript.exe, mshta.exe, rundll32.exe or regsvr32.exe.
- Search mail and download logs for .mpp files from external senders, and check whether recipients opened them.
- Review Group Policy, Intune or Cloud Policy reports for Project policies that disable internet macro blocking or enable all macros.

## What happened

On August 13, 2024, Microsoft fixed [CVE-2024-38189](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38189), a remote code execution flaw in Microsoft Project, and marked it "Exploitation Detected". CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38189) the same day, with a September 3, 2024 deadline. Microsoft scores it CVSS 3.1 8.8, and its temporal vector rates exploit code as functional. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-38189) lists only Microsoft's score. Microsoft credits no researcher and has not said who was targeted or published indicators. The [Zero Day Initiative](https://www.zerodayinitiative.com/blog/2024/8/13/the-august-2024-security-update-review) noted that "it's being exploited in the wild" and that it works only if "the target allows macros to run from the internet."

Microsoft's FAQ is specific about the preconditions. Exploitation "requires the victim to open a malicious Microsoft Office Project file on a system where the Block macros from running in Office files from the Internet policy is disabled and VBA Macro Notification Settings are not enabled." The file arrives by email or from a website, and the Preview Pane is not an attack vector.

## Who is affected

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-38189) lists the Project desktop app in Microsoft 365 Apps for Enterprise, Office 2019 and Office LTSC 2021, plus the MSI-based Project 2016. Microsoft's [security release notes](https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates) give the August 13, 2024 floors. Examples: Current Channel 2407 build 17830.20166, Monthly Enterprise Channel 2406 build 17726.20206, Semi-Annual Enterprise Channel 2402 build 17328.20550, Office LTSC 2021 build 14332.20763 and Office 2019 volume licensed build 10413.20020. Project 2016 MSI installs need [KB5002561](https://support.microsoft.com/help/5002561), which brings `Winproj.exe` to 16.0.5461.1001.

A related detail: Microsoft's [macro-blocking documentation](https://learn.microsoft.com/en-us/microsoft-365-apps/security/internet-macros-blocked) shows that Project only began blocking macros in internet files by default in those same August 13, 2024 builds. Word and Excel started getting that default in 2022.

## Do you really need to act?

Most fleets have nothing new to do. Click-to-Run Office updates itself, and the current builds (Current Channel 2609 build 20430.20182 as of October 13, 2026) are far past the floor. With default settings, macros in Project files from the internet are blocked. The exposure is narrower:

- **Loosened macro policy:** machines where an admin disabled the internet-macro block for Project, often for line-of-business macros, without enabling VBA macro notification settings. Microsoft names this exact configuration as the precondition.
- **Frozen installs:** Project 2016 MSI without KB5002561, and Office 2019 or LTSC 2021 volume builds held back by deployment rings.

If you have neither, record the build check for auditors and move on.

## What to do now

1. Check Click-to-Run builds with `Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' | Select-Object VersionToReport`. For Project 2016 MSI, check the version of `WINPROJ.EXE` against 16.0.5461.1001.
2. Update lagging Click-to-Run machines with `"C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user`, and install KB5002561 or a later Project 2016 update from Microsoft Update.
3. Enable "Block macros from running in Office files from the Internet" at `User Configuration\Policies\Administrative Templates\Microsoft Project 2016\Project Options\Security\Trust Center`. Use `gpresult /h gp.html` to find GPOs that disable it.
4. Where the block must stay off, enable "VBA Macro Notification Settings" for Project with "Disable all except digitally signed macros".
5. Flag or quarantine .mpp attachments from external senders.

## How to tell if you were hit

Microsoft has published no indicators. Hunt in EDR for `WINPROJ.EXE` launching `cmd.exe`, `powershell.exe`, `wscript.exe`, `mshta.exe`, `rundll32.exe` or `regsvr32.exe`, or writing executables to Temp or AppData. Inbound Project files are rare, so a mail-log search for external .mpp attachments usually produces a short list to review. If an unpatched machine with the macro block disabled opened one, treat it as possibly compromised and investigate it.

## Timeline

- Aug 13, 2024 — Microsoft fixes CVE-2024-38189 and marks it exploited. The same builds turn on default internet-macro blocking for Project. CISA adds the CVE to KEV.
- Aug 14, 2024 — Microsoft corrects the download links in its advisory.
- Sep 3, 2024 — CISA's remediation deadline for federal agencies.

## Sources

1. [Microsoft MSRC — CVE-2024-38189 Microsoft Project Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38189)
2. [Microsoft MSRC — August 2024 Security Updates (CVRF)](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Aug)
3. [Microsoft Support — Security update for Project 2016: August 13, 2024 (KB5002561)](https://support.microsoft.com/help/5002561)
4. [Microsoft Learn — Release notes for Microsoft 365 Apps security updates](https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates)
5. [Microsoft Learn — Macros from the internet are blocked by default in Office](https://learn.microsoft.com/en-us/microsoft-365-apps/security/internet-macros-blocked)
6. [CVE record — CVE-2024-38189](https://www.cve.org/CVERecord?id=CVE-2024-38189)
7. [NVD — CVE-2024-38189](https://nvd.nist.gov/vuln/detail/CVE-2024-38189)
8. [CISA — Known Exploited Vulnerabilities: CVE-2024-38189](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38189)
9. [Zero Day Initiative — The August 2024 Security Update Review](https://www.zerodayinitiative.com/blog/2024/8/13/the-august-2024-security-update-review)

---
Source page: https://erroneo.us/security/briefs/microsoft-project-cve-2024-38189-macro-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt