CVE-2021-34478

What it actually does

This is a Microsoft Office remote code execution vulnerability triggered through local handling of a malicious Office document or Office-supported file content. The CVSS vector indicates exploitation requires user interaction but no attacker privileges: a victim must open or preview attacker-controlled content. Successful exploitation can execute code in the context of the signed-in user, giving the attacker the same access to files, network resources, credentials, and applications available to that user. Because confidentiality, integrity, and availability impacts are all rated high, exploitation can support data theft, payload installation, document tampering, lateral movement preparation, or destructive activity depending on the user’s privileges and endpoint controls.

Why it matters to the business

If users open a malicious Office file, attackers may gain control of their workstation account and use it to steal sensitive documents, deploy malware, or move further into the organization. This is especially relevant because Microsoft Office and Microsoft 365 Apps are widely deployed and commonly targeted through email attachments, links, file shares, and collaboration platforms. The vulnerability is older and not currently listed in CISA KEV, but the EPSS score is elevated, so organizations should still treat unpatched Office installations as meaningful phishing-driven compromise risk.

How an attack unfolds

An attacker typically crafts a malicious Office document or related file that triggers the vulnerable code path when opened or rendered by Microsoft Office. The file is delivered through a phishing email, malicious download link, compromised website, file-sharing service, or collaboration channel. A user opens or previews the content, satisfying the required user interaction. If the target Office installation is vulnerable, attacker-controlled code executes with the victim user’s privileges. The attacker can then launch a second-stage payload, establish persistence, access local and network-accessible files, harvest credentials or tokens available to the user, and use the compromised endpoint as a foothold for further activity.

How to fix it

Apply the Microsoft security updates that address CVE-2021-34478 for all affected Microsoft Office and Microsoft 365 Apps installations. Because no fixed version list was provided, use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, Microsoft 365 Apps update channels, or the Microsoft Update Catalog to ensure Office builds include the August 2021 security fixes or later. Prioritize internet-facing user populations, users who frequently receive external documents, shared workstations, and systems where Office can open email attachments or downloaded files. If immediate patching is not possible, reduce exposure by disabling Office macros from the internet, enforcing Protected View and Application Guard for Office where available, blocking automatic execution of active content, restricting child process creation from Office applications, and using email/web filtering to detonate or block suspicious Office files.

How to confirm the fix worked

Confirm affected Office products are updated to a build containing the August 2021 Microsoft Office security update or later. Validate through centralized patch reporting, Microsoft 365 Apps admin center inventory, endpoint management tooling, or local Office version checks. On endpoints, verify Office update channels are active and not pinned to unsupported builds. Test mitigations by confirming Protected View, macro restrictions, attachment scanning, and attack surface reduction rules are enforced. For exposure assessment, inventory devices with Microsoft Office or Microsoft 365 Apps installed and identify any installations missing security updates released on or after the vulnerability’s patch date.

Typical attack path

1. Attacker identifies organizations likely to use Microsoft Office or Microsoft 365 Apps and prepares a malicious document or Office-supported file.
2. Attacker sends the file or link through phishing email, social engineering, a compromised trusted sender, web hosting, or a collaboration platform.
3. Victim opens or previews the malicious content in a vulnerable Office application.
4. The vulnerable Office component processes the crafted content and executes attacker-controlled code under the victim user context.
5. Attacker launches a payload such as a downloader, remote access tool, script interpreter, or credential theft component.
6. Attacker establishes command and control, collects data, and attempts privilege escalation or lateral movement if endpoint and identity controls allow it.

How to detect it

Investigate whether this was already exploited by correlating email, web proxy, endpoint detection, and Office process telemetry. Focus on timelines where users opened unexpected Office attachments or downloaded Office documents shortly before suspicious process creation. Look for Office applications spawning command shells, PowerShell, Windows Script Host, MSHTA, rundll32, regsvr32, certutil, bitsadmin, curl, wscript, cscript, or unknown executables. Review EDR events for payload drops in user-writable directories, new persistence mechanisms created shortly after Office document execution, outbound network connections initiated by Office or its child processes, and credential-access tooling launched from a user session. Email security logs should be searched for malicious or unusual Office attachments, archive files containing Office documents, external senders impersonating trusted contacts, and links to document downloads. Because no public exploit-specific artifact is provided, detection should be behavior-based rather than relying on a single static signature.

• WINWORD.EXE -> cmd.exe
• WINWORD.EXE -> powershell.exe
• WINWORD.EXE -> wscript.exe
• WINWORD.EXE -> cscript.exe
• WINWORD.EXE -> mshta.exe
• WINWORD.EXE -> rundll32.exe
• WINWORD.EXE -> regsvr32.exe
• WINWORD.EXE -> certutil.exe
• WINWORD.EXE -> bitsadmin.exe
• EXCEL.EXE -> cmd.exe
• EXCEL.EXE -> powershell.exe
• EXCEL.EXE -> wscript.exe
• EXCEL.EXE -> cscript.exe
• EXCEL.EXE -> mshta.exe
• EXCEL.EXE -> rundll32.exe
• EXCEL.EXE -> regsvr32.exe
• POWERPNT.EXE -> cmd.exe
• POWERPNT.EXE -> powershell.exe
• POWERPNT.EXE -> mshta.exe
• OUTLOOK.EXE -> WINWORD.EXE
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
• %TEMP%\*.exe
• %TEMP%\*.dll
• %APPDATA%\*.exe
• %LOCALAPPDATA%\Temp\*.exe
• powershell -enc
• powershell -EncodedCommand
• certutil -urlcache -split -f
• bitsadmin /transfer
• mshta http
• rundll32 url.dll,FileProtocolHandler

What your security team should do

• Patch or update all Microsoft Office and Microsoft 365 Apps installations to builds containing the August 2021 security fixes or later.
• Prioritize remediation on endpoints used by high-risk users, including executives, finance, legal, HR, administrators, and users who regularly process external documents.
• Enable Microsoft Defender Attack Surface Reduction rules that block Office from creating child processes, creating executable content, and injecting into other processes where operationally feasible.
• Enforce Protected View, Mark-of-the-Web handling, and macro blocking for files from the internet.
• Harden email and collaboration defenses to sandbox or block suspicious Office attachments and links.
• Monitor Office process behavior for suspicious child processes, script interpreters, dropped executables, or network connections after document open events.
• Review historical endpoint and email telemetry for malicious Office attachments or exploitation-like process chains around suspected phishing events.
• Educate users to treat unexpected Office attachments or document links as high risk, especially when they prompt for enabling content or editing.