CVE-2021-38646
Published: 15 September 2021
Summary
CVE-2021-38646 is a high-severity an unspecified weakness vulnerability in Microsoft Office. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 2.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-7 (Least Functionality).
Deeper analysis
The vulnerability is a remote code execution flaw in the Microsoft Office Access Connectivity Engine, assigned CVE-2021-38646 with a CVSS 3.1 base score of 7.8. It affects the Access Connectivity Engine component within Microsoft Office installations.
An unauthenticated local attacker can trigger the issue by convincing a user to open a specially crafted file, resulting in arbitrary code execution with high impact to confidentiality, integrity, and availability on the affected system.
Microsoft's security advisory provides official guidance on available patches and mitigations for the vulnerability. The issue is also tracked in CISA's catalog of known exploited vulnerabilities, confirming observed real-world exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-25085
Vulnerability details
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
- CWE(s)
- KEV Date Added
- 28 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of vendor patches for the Access Connectivity Engine flaw, which is the primary mitigation listed in the Microsoft advisory and CISA KEV entry.
Malicious-code protection mechanisms can inspect and block specially crafted Office files before the Access Connectivity Engine processes them.
Least-functionality configuration can disable or restrict the Access Connectivity Engine component when it is not required, reducing the attack surface for crafted-file RCE.