What is CVE-2021-27055?

CVE-2021-27055 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Microsoft Visio Security Feature Bypass Vulnerability

Which CVE IDs does CVE-2021-27055 cover?

CVE-2021-27055 covers the following CVE IDs: CVE-2021-27055. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2021-27055?

CVE-2021-27055 has a CVSS v3 base score of 7.0, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2021-27055?

CVE-2021-27055 affects 10 products, including: Microsoft 365 Apps for Enterprise for 32-bit Systems; Microsoft 365 Apps for Enterprise for 64-bit Systems; Microsoft Office 2019 for 32-bit editions; Microsoft Office 2019 for 64-bit editions; Microsoft Visio 2010 Service Pack 2 (32-bit editions); and others — see the full list on the advisory page.

CVE-2021-27055HighCVSS 7.0

Microsoft Visio Security Feature Bypass Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

March 9, 2021

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2021-27055 →

📋 Description

How could an attacker exploit this vulnerability? Initially an Administrator would need to set a Group Policy in a specific way. Then, an attacker would then need to modify a macro-enabled template that ships with Excel. Then the attacker needs to convince a target to run that malicious file on a system affected by that Policy.

Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector.

🎯 Affected products10

Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Office 2019 for 32-bit editions
Microsoft Office 2019 for 64-bit editions
Microsoft Visio 2010 Service Pack 2 (32-bit editions)
Microsoft Visio 2010 Service Pack 2 (64-bit editions)
Microsoft Visio 2013 Service Pack 1 (32-bit editions)
Microsoft Visio 2013 Service Pack 1 (64-bit editions)
Microsoft Visio 2016 (32-bit edition)
Microsoft Visio 2016 (64-bit edition)

✅ Remediation

KB4486673 (Security Update) — fixed build 15.0.5327.1000 KB4493151 (Security Update) — fixed build 16.0.5134.1000 KB4484376 (Security Update) — fixed build 14.0.7266.5000 KBClick to Run (Security Update) — fixed build https://aka.ms/OfficeSecurityReleases

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products10

✅ Remediation

🔗 References (11)