CVE-2021-38646

This vulnerability is like a “hidden trap” inside a Microsoft Office file. If someone opens the malicious file, the attacker may be able to run code on the device without needing a login. For small businesses, that can quickly lead to ransomware or other damage if the device is compromised.

This matters if you run Microsoft Office or Microsoft 365 Apps on your computers—especially if you have Microsoft Office 2013 RT Service Pack 1. It’s mainly a risk when a user is tricked into opening a malicious, specially crafted Office file.

Reachability gate: there’s no risk from just having the software installed; it becomes a practical risk when the crafted file is opened in Microsoft Office (CISA reports real-world use in ransomware campaigns).

This is RED because it has been confirmed in CISA’s Known Exploited Vulnerabilities list and was used in ransomware campaigns. Attackers can target your organization through everyday social engineering—sending files that rely on a user opening them in Microsoft Office. Act now to remove the vulnerable code paths by applying the vendor updates.

1. Inventory your endpoints:

   • Identify machines that have Microsoft Office 2013 RT Service Pack 1 or Microsoft 365 Apps installed.
   • Confirm which version/build is installed on each device.

2. Confirm exposure:

   • If any device uses the affected Microsoft Office builds, plan remediation for that device.
   • Use Microsoft’s update guidance for CVE-2021-38646 to map your installed build to whether it is fixed.

3. Apply the fixed versions:

   • Microsoft Office: update to a fixed build listed in Microsoft’s security releases for CVE-2021-38646 (the provided fixed builds include 5215.1000 and 5381.1000).
   • Microsoft 365 Apps: update to the fixed releases listed in Microsoft’s security releases for CVE-2021-38646.
   • Use Microsoft’s “Office security releases”/update guide links referenced for CVE-2021-38646.

4. If patching is delayed (temporary containment):

   • Block or restrict opening unknown/suspicious Office attachments via your email security controls.
   • Ensure users are instructed not to open unexpected Office files and to report suspicious messages immediately.
   • Tighten attachment handling for external emails until devices are patched.

5. What to monitor after updating:

   • Watch for suspicious Office activity around the times users opened attachments (unexpected child processes or unusual execution behavior).
   • Continue monitoring endpoint alerts for malware/ransomware behavior, especially after any phishing-like email.

CISA due date (for KEV): 2022-04-18.

Severity is rated HIGH with a reported impact of confidentiality, integrity, and availability. The vulnerability provides remote code execution in the Microsoft Office Access Connectivity Engine, but exploitation requires user interaction: an attacker convinces a victim to open a specially crafted file. CISA KEV confirms real-world exploitation in ransomware campaigns (added 2022-03-28), which drives the RED urgency regardless of predictive likelihood.

Exploit maturity: confirmed exploited-in-the-wild per KEV. No public exploit code was identified in the provided findings. EPSS is reported as a prediction (trend falling), but KEV confirmation is the decisive factor here.

Attack vector summary from findings: local triggering via a maliciously crafted Office file opened by the user; no authentication is required.