CVE-2021-27054: 
vulnerability analysis and mitigation

Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-27054) was discovered and reported to Microsoft on December 18, 2020, with public disclosure occurring on May 5, 2021. The vulnerability affects multiple versions of Microsoft Excel and Microsoft Office, including Excel 2010 SP2, 2013 SP1, 2016, and Microsoft 365 Apps Enterprise (ZDI Advisory).

The vulnerability is a use-after-free flaw that exists within the parsing of XLS files. The specific issue results from the lack of validating the existence of an object prior to performing operations on the object. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Excel. The attacker can leverage this vulnerability to execute code in the context of the current process, potentially gaining the same privileges as the logged-in user (ZDI Advisory).

User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file. The attack requires the victim to voluntarily interact with the attack mechanism (NVD).

Microsoft has issued a security update to address this vulnerability. Users are advised to apply the latest security updates available through the Microsoft Security Response Center (MSRC Advisory).