CVE-2021-43875: Microsoft 365 Apps RCE Vulnerability

CVE-2021-43875 Overview

CVE-2021-43875 is a Remote Code Execution vulnerability affecting Microsoft Office Graphics components. This vulnerability exists in the graphics rendering functionality of Microsoft Office products, allowing attackers to execute arbitrary code on a target system when a user opens a specially crafted document or file.

Critical Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the current user. If the user has administrative rights, the attacker could gain full control of the affected system, install programs, modify data, or create new accounts.

Affected Products

• Microsoft 365 Apps for Enterprise (x64 and x86)
• Microsoft Office 2019 (Windows x64, x86, and macOS)
• Microsoft Office 2021 LTSC (Windows x64, x86, and macOS)

Discovery Timeline

• December 15, 2021 - CVE-2021-43875 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-43875

Vulnerability Analysis

This Remote Code Execution vulnerability resides in the graphics processing component of Microsoft Office applications. The vulnerability requires local access and user interaction—specifically, an attacker must convince a user to open a malicious file. Once opened, the crafted file can trigger the vulnerability during graphics rendering, potentially leading to complete system compromise.

The attack scenario typically involves social engineering, where an attacker sends a specially crafted Office document via email or hosts it on a malicious website. When the victim opens the document, the malicious graphics content is processed by the vulnerable component, leading to code execution in the context of the current user.

Root Cause

The vulnerability stems from improper handling of graphics data within Microsoft Office applications. While specific technical details have not been publicly disclosed by Microsoft (classified as NVD-CWE-noinfo), the issue involves unsafe processing of graphical elements that can be exploited through carefully constructed input to achieve arbitrary code execution.

Attack Vector

The attack requires local access with user interaction. An attacker cannot remotely exploit this vulnerability without first convincing a user to open a malicious file. The attack flow typically follows this pattern:

1. Attacker creates a specially crafted Office document containing malicious graphics content
2. Document is delivered to the victim via email attachment, file sharing, or compromised website
3. Victim opens the document in a vulnerable version of Microsoft Office
4. The graphics rendering component processes the malicious content
5. Code execution occurs with the privileges of the logged-in user

No verified proof-of-concept code is publicly available for this vulnerability. The exploitation mechanism involves crafted graphics data that triggers unsafe processing within Microsoft Office's rendering pipeline. For technical implementation details, refer to the Microsoft Security Advisory.

Detection Methods for CVE-2021-43875

Indicators of Compromise

• Unusual Office application crashes or unexpected behavior when opening documents
• Suspicious child processes spawned by Microsoft Office applications (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE)
• Unexpected network connections originating from Office processes
• Presence of newly created files or registry modifications following document opening

Detection Strategies

• Monitor Office applications for suspicious child process creation, particularly command shells or scripting engines
• Implement file-based detection rules for malformed Office documents with unusual graphics content
• Deploy endpoint detection solutions capable of identifying memory corruption exploitation attempts
• Enable Windows Defender Exploit Guard or similar endpoint protection with attack surface reduction rules

Monitoring Recommendations

• Enable and review Microsoft Office audit logs for document opening events
• Monitor process execution chains starting from Office applications
• Implement network traffic analysis for anomalous outbound connections from Office processes
• Configure SIEM alerts for Office application crashes followed by suspicious activity

How to Mitigate CVE-2021-43875

Immediate Actions Required

• Apply the latest security updates from Microsoft to all affected Office installations
• Enable Protected View for documents from the Internet and email attachments
• Implement application whitelisting to prevent unauthorized code execution
• Restrict macro execution in Office applications through Group Policy

Patch Information

Microsoft has released security updates to address this vulnerability. Administrators should apply patches through the standard Microsoft Update channels or Windows Server Update Services (WSUS). Detailed patch information and download links are available in the Microsoft Security Advisory for CVE-2021-43875.

For enterprise environments, use Configuration Manager or Intune to deploy updates to Microsoft 365 Apps and Microsoft Office installations. Ensure all supported versions (Office 2019, Office 2021 LTSC, and Microsoft 365 Apps) are updated.

Workarounds

• Enable Protected View for all external documents to prevent automatic code execution
• Configure Office applications to open Internet-sourced files in read-only mode
• Disable the Preview Pane in Windows Explorer to prevent automatic file parsing
• Train users to avoid opening unexpected or suspicious Office documents from untrusted sources
• Consider implementing Microsoft Defender Application Guard for Office in enterprise environments

# Enable Protected View settings via Registry
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f