CVE-2021-34501: 
vulnerability analysis and mitigation

Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-34501) was discovered and reported on April 16, 2021, with public disclosure occurring on August 11, 2021. This vulnerability affects Microsoft Excel installations and is specifically related to the parsing of CONTINUEFRT12 records within XLS files (ZDI Advisory).

The vulnerability exists within the parsing of CONTINUEFRT12 records within XLS files. The specific flaw stems from improper validation of user-supplied data length before copying it to a heap-based buffer. The vulnerability has been assigned a CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating its high severity (ZDI Advisory).

When successfully exploited, this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected Microsoft Excel installations. The attack requires user interaction, specifically the target must either visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires user interaction for successful exploitation. An attacker would need to convince a user to open a specially crafted malicious file or visit a malicious webpage to execute arbitrary code (ZDI Advisory).

Microsoft has released security updates to address this vulnerability. The fixes are available through patches KB5001977 for Microsoft Excel 2016 and KB5001973 for Microsoft Office Online Server (Rapid7).