The vulnerability of the Microsoft Office Access Connectivity Engine component of the Microsoft Office software suite, related to improper code generation, allows a malicious actor to execute arbitrary code.

🗓️ 20 May 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

The vulnerability in Microsoft Office Access Connectivity Engine allows arbitrary code execution.

Reporter	Title	Published	Views	Family All 23
ATTACKERKB	CVE-2021-38646	15 Sep 202100:00	–	attackerkb
Circl	CVE-2021-38646	24 Oct 202107:35	–	circl
CISA KEV Catalog	Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability	28 Mar 202200:00	–	cisa_kev
CNNVD	Microsoft Office 缓冲区错误漏洞	14 Sep 202100:00	–	cnnvd
CVE	CVE-2021-38646	15 Sep 202111:24	–	cve
Cvelist	CVE-2021-38646 Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability	15 Sep 202111:24	–	cvelist
Microsoft KB	Description of the security update for Office 2013: September 14, 2021 (KB5001958)	14 Sep 202107:00	–	mskb
Microsoft KB	Description of the security update for Office 2016: September 14, 2021 (KB5001997)	14 Sep 202107:00	–	mskb
Kaspersky	KLA12288 Multiple vulnerabilities in Microsoft Office	14 Sep 202100:00	–	kaspersky
Microsoft CVE	Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability	14 Sep 202107:00	–	mscve

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-38646
msrc	www.msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-38646
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

24 Sep 2024 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 27.2

CVSS 37.8

EPSS0.50932

Microsoft Office Access Connectivity Engine Code generation issue Arbitrary code execution Vulnerability