CVE-2021-42292

Deeper analysis

Microsoft Excel contains a security feature bypass vulnerability that allows an attacker to circumvent protections in the application. The flaw affects Microsoft Excel and carries a CVSS 3.1 base score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector, low complexity, no privileges required, and required user interaction to achieve high impact on confidentiality, integrity, and availability.

An attacker can exploit the issue by supplying a specially crafted file that a user opens locally in Excel. Successful exploitation bypasses security controls and can lead to arbitrary code execution or other high-impact actions on the affected system without needing elevated privileges.

Microsoft has published guidance in its security advisory for CVE-2021-42292, and the vulnerability appears in CISA's catalog of known exploited vulnerabilities, confirming observed in-the-wild exploitation.