CVE-2021-34501: Microsoft Excel remote code execution via crafted file

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution in a widely deployed Office product with a high EPSS score and user-interaction-only reach warrants prompt patching despite no KEV listing.

What it is

CVE-2021-34501 is a remote code execution flaw in Microsoft Excel and related Office products. The record gives only the title-level description, so the specific memory-safety or parsing defect is not identified. It matters because successful exploitation runs attacker code in the context of the opening user.

Impact

An attacker who convinces a user to open a malicious file can execute arbitrary code with the privileges of that user. That typically means full compromise of the user's session and data, not just a crash.

Attack surface

The vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), which matches a malicious document opened in Excel. No authentication is needed; the victim must open the crafted file.

Exploitation

CISA KEV does not list it and no ransomware use is documented, but EPSS is high at roughly 0.51 (98.9th percentile), indicating elevated predicted exploitation activity. References include a vendor patch advisory and a third-party advisory, with no public exploit tag.

What to do

• Apply the Microsoft security update for CVE-2021-34501 to Excel, Office, and Office Online Server as applicable.
• Enable Protected View and block macros and untrusted file types from email and web sources.
• Use attack surface reduction rules and Defender for Office 365 to block Office child-process creation and executable content.
• Restrict users from opening documents from untrusted locations and enforce Mark-of-the-Web handling.
• Keep Office patched through a managed update channel and verify the fix is installed on all endpoints.

Detection

• Monitor for Excel spawning child processes such as cmd.exe, powershell.exe, or script hosts.
• Alert on Office applications loading unusual DLLs or writing executables to temp or startup paths.
• Review email and web gateway logs for Excel attachments or downloads from untrusted senders.
• Hunt for suspicious file writes and process creation shortly after a document open event on endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.