PT-2021-4715 · Microsoft · Office Visio

Khangkito + 1 · Published 2021-07-28 · Updated 2023-08-01 · CVE-2021-40480

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office Visio (affected versions not specified)

Description The issue is caused by errors in array indexing when parsing EMF files, allowing an attacker to execute arbitrary code using a specially crafted file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

BDU:2021-05419

CVE-2021-40480

ZDI-21-1159

Affected Products

Office Visio

References · 6

• https://zerodayinitiative.com/advisories/ZDI-21-1159 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-40480 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40480 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40480 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05419 · Security Note
• https://cybersecurity-help.cz/vulnerabilities/57270 · Note