CVE-2021-38646
Microsoft Office 2013
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-38646 is a high-severity an unspecified weakness vulnerability in Microsoft Office. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability is a remote code execution flaw in the Microsoft Office Access Connectivity Engine, assigned CVE-2021-38646 with a CVSS 3.1 base score of 7.8. It affects the Access Connectivity Engine component within Microsoft Office installations.
An unauthenticated local attacker can trigger the issue by convincing a user to open a specially crafted file, resulting in arbitrary code execution with high impact to confidentiality, integrity, and availability on the affected system.
Microsoft's security advisory provides official guidance on available patches and mitigations for the vulnerability. The issue is also tracked in CISA's catalog of known exploited vulnerabilities, confirming observed real-world exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-25085
Vulnerability Data
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
- CWE(s)
- KEV Date Added
- 28 March 2022
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.