Main Vulnerability Database Vulnerabilities #VU57264

Use-after-free in Microsoft products - CVE-2021-40474

Published: October 12, 2021 / Updated: October 13, 2021

Vulnerability identifier: #VU57264

CSH Severity: High

CVSS v4 BT: 7.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2021-40474

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when parsing Microsoft Excel files. A remote attacker can create a specially crafted Microsoft Excel file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Affected software

Microsoft Excel
Microsoft Office
Microsoft Office Web Apps Server
Office Online Server

How to mitigate CVE-2021-40474

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40474

Related Security Bulletins