CVE-2021-38646
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Description
CVE-2021-38646 is a remote code execution vulnerability in Microsoft Office that allows an attacker to execute arbitrary code on a victim's system when the user opens a specially crafted Office document. The vulnerability requires user interaction in the form of opening a malicious document, which can be delivered via email, web download, or file sharing. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 2.9% (91.3rd percentile), this vulnerability has been leveraged in targeted attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | 365 apps | - |
| microsoft | office | 2013 |
| microsoft | office 2016 | - |
| microsoft | office 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38646(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38646(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38646(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection occurs when an application processes untrusted data in a way that allows the injection and execution of arbitrary code. In CVE-2021-38646, specially crafted Office document content triggers a code execution path in Microsoft Office, allowing attackers to run arbitrary code when the document is opened. For more details, see CWE-94.
Impact Analysis
Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user who opens the malicious document. If the user has administrative privileges, the attacker gains full system control. Even with standard user privileges, the attacker can access the user's files, email, and network resources. Office document-based attacks are particularly effective in business environments where document sharing is routine, and users are accustomed to opening documents from colleagues, partners, and clients. The social engineering aspect of delivering a malicious document through legitimate-looking emails makes this attack vector highly reliable for targeted intrusions.
Exploit Maturity
CVE-2021-38646 was added to CISA's KEV catalog on March 28, 2022, confirming active exploitation. The EPSS score of 2.9% (91.3rd percentile) indicates active but primarily targeted exploitation, consistent with spear-phishing campaigns. Microsoft Office vulnerabilities are consistently among the most popular attack vectors for targeted intrusion operations, as they combine reliable exploitation with the high likelihood that targets will open document attachments. The exploitation requires user interaction (opening a document), which limits mass exploitation but is highly effective in targeted scenarios.
Remediation
- Apply the Microsoft Office security update from September 2021 that addresses this vulnerability, as required by CISA's KEV catalog.
- Enable Protected View in Microsoft Office to open documents from untrusted sources in a sandboxed read-only mode.
- Implement email security solutions that scan attachments for malicious content before delivery to end users.
- Train users to exercise caution when opening documents from unknown or unexpected sources, even if they appear to come from trusted contacts.
- Deploy application control policies that restrict macro execution and active content in Office documents from external sources.
Technical Details
The vulnerability exists in the way Microsoft Office processes certain content elements within Office documents. When a user opens a specially crafted document, the malicious content triggers a code execution vulnerability in the Office application's document parsing logic. The attacker constructs the document to exploit specific parsing behaviors that allow overwriting memory or redirecting execution flow. The resulting code execution occurs in the context of the Office application process with the same privileges as the user. The attack specifically requires user interaction in the form of opening the malicious document, though no additional actions beyond opening the file are required to trigger the exploit.
Frequently Asked Questions
What is CVE-2021-38646?
CVE-2021-38646 is a remote code execution vulnerability in Microsoft Office. When a user opens a specially crafted malicious document, arbitrary code can be executed on their system with the user's privileges.
Which Office products are affected?
The vulnerability affects multiple versions of Microsoft Office including Office 2019 and Microsoft 365 Apps. Check Microsoft's security advisory for the complete list of affected products and versions.
Can this be triggered automatically?
No, the vulnerability requires user interaction. The victim must open a malicious document for the exploit to trigger. However, attackers commonly use social engineering through spear-phishing emails to convince targets to open malicious attachments.
Does Protected View prevent exploitation?
Protected View provides an additional layer of defense by opening documents from untrusted sources in a sandboxed read-only mode. However, if a user clicks "Enable Editing" to leave Protected View, the exploitation can proceed. Users should be cautious about leaving Protected View for documents from untrusted sources.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.