CVE-2021-34478: Microsoft Office Remote Code Execution Vulnerability

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.8 with high EPSS and full code execution impact, though exploitation requires user interaction and no in-the-wild activity is confirmed.

What it is

CVE-2021-34478 is a remote code execution flaw in Microsoft Office and Microsoft 365 Apps. The record provides only a generic description and no root-cause detail, so the specific vulnerable component is not identified. It matters because successful exploitation gives an attacker full code execution in the context of the affected user.

Impact

An attacker who convinces a user to open a crafted document can execute arbitrary code with the privileges of that user. This can lead to full compromise of confidentiality, integrity and availability on the host.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), meaning the attack is reached by getting a victim to open a malicious file rather than by remote network access. No authentication is needed, but the victim must interact with the crafted content.

Exploitation

CISA KEV does not list this CVE and no ransomware use is documented. EPSS is high (0.51243, 98.9th percentile), indicating a meaningful predicted likelihood of exploitation, but the references contain no exploit or in-the-wild tags.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2021-34478 as the first action.
• Keep Microsoft Office and Microsoft 365 Apps on a supported, fully patched channel and enforce automatic updates.
• Block or restrict execution of untrusted Office file types (for example via Attachment Manager, Protected View and file-block policies) from email and web sources.
• Enable and enforce Protected View and disable macros for documents from untrusted locations.
• Educate users not to open unexpected Office attachments or links from unknown senders.

Detection

• Monitor for Office applications (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Alert on Office processes loading unusual DLLs or writing executables to user-writable paths such as %TEMP% or %APPDATA%.
• Review endpoint telemetry for document opens followed by network connections or script execution from Office parent processes.
• Hunt for known exploit indicators from the ZDI advisory ZDI-21-1024 in file and process telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.