CVE-2021-27055: 
vulnerability analysis and mitigation

Microsoft Visio Security Feature Bypass Vulnerability (CVE-2021-27055) was disclosed on March 9, 2021. This vulnerability affects multiple versions of Microsoft Visio, including Visio 2010 Service Pack 2, Visio 2013, Visio 2016, and Microsoft 365 Apps Enterprise (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.0 (HIGH) with the vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVSS v2.0 base score is 6.8 (MEDIUM) with vector (AV:N/AC:M/Au:N/C:P/I:P/A:P) (NVD).

The vulnerability could allow security feature bypass in Microsoft Visio if successfully exploited, potentially compromising the confidentiality, integrity, and availability of the affected system (Rapid7).

The vulnerability requires user interaction and has high attack complexity. The attack vector is local, requiring no privileges for exploitation (NVD).

Microsoft has released security updates to address this vulnerability. Users should apply the appropriate security updates for their version of Microsoft Visio. For Visio 2010 users, security update KB4484376 is available through Microsoft Update, Microsoft Update Catalog, or Microsoft Download Center (Microsoft Support).