Vulnerability Spotlight: Use-after-free vulnerability in Microsoft Excel could lead to code execution

Summary: Cisco Talos's Marcin "Icewall" Noga discovered a use-after-free vulnerability in the ConditionalFormatting functionality of Microsoft Office Excel 2019 that could allow arbitrary code execution if an attacker tricks a target into opening a specially crafted Excel file. Microsoft patched it as CVE-2021-40474 in its monthly security update, and Talos says proper heap grooming could give an attacker full control of the flaw; affected versions include Office Excel 2019 x86 (version 2101, build 13628.20448) and Office Excel 365 x86 (version 2008, build 13127.21216).
Bottom line: Exploitation requires only that a user open a crafted spreadsheet, and heap grooming can turn this use-after-free into full code execution on the victim machine - a low bar for an attacker and a routine action for your users.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-40474
Related: Microsoft Patch Tuesday for Oct. 2021 — Snort rules and prominent vulnerabilities Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026