Four security vulnerabilities found in the Microsoft Office suite, which includes Excel and office online, could be probably harmed by such bad attackers to transmit adversary code using Word and Excel documents.

“Fixed from tradition code, the susceptibility could have permitted the threat attackers the ability to run the code on the pointing device through malicious Office documents, like Word, Excel and Outlook,” the researchers said from the investigation reported today.

In 2021 Patch Tuesday updates, Microsoft fixed three of four bugs – tracked as CVE-2021-31174, CVE-2021-31178, CVE-2021-31179, with the fourth bug (CVE-2021-31939) to be concerned in June’s update rolling out later today.

In a speculative attack scenario, the investigators mentioned by their researches that the susceptibility could be generated as easier as executing a malicious Excel (.XLS) file that’s shared by a download link or an email. That’s why it becomes easier for threat actors to execute such vulnerabilities.

When we come out of interpreting mistakes made in traditional code in Excel 95 file formats, the susceptibility was detected by misrepresenting MSGraph (“MSGraph.Chart.8”), an approximately under-investigate component in Microsoft Office items that’s at par to Microsoft Equation Editors in terms of the attack surface. Equation Editor a vanished feature in Word, has now become a part of the arsenal of some –related threat attackers at least since late 2018.

What are the Major Vulnerabilities?

Researchers said from the investigations that, “Since the entire Office apartment has the capability to add Excel objects, this increase the attack vector, making it conceivable to implement such attacks on almost Office Software, consist up of Word, Outlook and so on.”

All the four vulnerabilities are mentioned below:

• CVE-2021-31179 – Remote Code Execution Vulnerability of Microsoft Office.

• CVE-2021-31174 – Information Disclosure Vulnerability of Microsoft Excel.

• CVE-2021-31178 – Information Disclosure Chinese Vulnerability of Microsoft Office.

• CVE-2021-31939 – Remote Code Execution Vulnerability of Microsoft Excel.

From all of the above mentioned vulnerabilities, Microsoft mentioned in its advisories for CVE-2021-31179 and CVE-2021-31939 that the utilization of the vulnerability needs that a victim launches a specially-crafted file, computing the adversary would have to manipulate users into clicking the given link that directly redirects the user to the malicious coded documents.

Where the Vulnerability affects the most?

“The Susceptibility discovers affect almost on the overall Microsoft Office environment,” concluded our researchers during an investigation. “There are several ways to execute such an attack on almost every Office Software, such as Word, Excel, Outlook, Access and others.

 One of the major detections from the research is that the tradition code consistent to be weak link in the protection chain, especially in complex structured application software like Microsoft Office.”

By concluding this, it is highly recommended for Windows users to administrate the patches as soon as possible to reduce the high chance of risk and avoid such attacks that could abuse the introductory weakness and secure your device with such vulnerabilities.