Published: 13/10/2021 Updated: 01/08/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

This vulnerability allows remote malicious users to execute arbitrary code on affected installations of Microsoft Office. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DOC files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft word 2013
microsoft word 2016
microsoft office web apps server 2013
microsoft sharepoint enterprise server 2016
microsoft office online server -
microsoft sharepoint enterprise server 2013
microsoft office 2019
microsoft sharepoint server 2019

Microsoft Patch Tuesday bug harvest festival comes to town

The Register • Thomas Claburn in San Francisco • 12 Oct 2021

Get our weekly newsletter With 71 new CVEs, there are patches enough for everyone

Microsoft's October Patch Tuesday has arrived with fixes for 71 new CVEs, two patch revisions to address bugs from previous months that just won't die, and three CVEs tied to OpenSSL flaws. That's in addition to eight Edge-Chromium CVEs dealt with earlier this month. Two of the fresh bugs are rated Critical, 68 are designated Important, and one is rated Low severity. Four among the overall October harvest have been publicly disclosed, including one from July, an Azure AD security feature bypass ...

CVE-2021-40486

Vulnerability Summary

Vulnerability Trend

Recent Articles

References

Vulmon Search

About

Products

Connect