CVE-2021-1716: 
vulnerability analysis and mitigation

Microsoft Word Remote Code Execution Vulnerability (CVE-2021-1716) was disclosed on January 12, 2021. This vulnerability affects Microsoft Word and Office Online Server installations. The vulnerability could allow remote code execution if a user opens a specially crafted Office file (Microsoft Support, CVE Mitre).

The vulnerability exists in Microsoft Word and Office Online Server that could allow remote code execution through specially crafted Office files. The security update addresses the vulnerability by correcting how Microsoft Word handles objects in memory (Microsoft Support).

If successfully exploited, an attacker could gain the ability to execute arbitrary code in the context of the current user. If the current user has administrative privileges, the attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights (Microsoft Support).

The vulnerability requires user interaction, where a target must open a specially crafted file to trigger the exploitation. No evidence of active exploitation in the wild was reported at the time of disclosure (Microsoft Support).

Microsoft released security updates to address this vulnerability. Users should apply the security update KB4493156 for Word 2016 or the appropriate update for their specific version of Microsoft Office. The updates are available through Microsoft Update, Microsoft Update Catalog, and Microsoft Download Center (Microsoft Support).