Cyber Resilience

CVE-2025-21298

Critical

Published: 14 January 2025

Published
14 January 2025
Modified
24 January 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.7803 99.0th percentile
Risk Priority 66 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-21298 is a critical-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-21298 is a remote code execution vulnerability in the Windows OLE component, stemming from a use-after-free flaw (CWE-416). It affects Microsoft Windows systems and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required privileges or user interaction and full impact on confidentiality, integrity, and availability.

An unauthenticated attacker can send specially crafted network traffic or documents that trigger the flaw, allowing arbitrary code execution with the privileges of the affected process and potential full system compromise.

The primary advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21298 directs administrators to apply the corresponding Microsoft security update, which addresses the underlying memory-safety issue in OLE.

The vulnerability shows a high exploitation probability with an EPSS score of 0.7803 (peak 0.7896), indicating substantial attacker interest following disclosure.

EU & UK References

Vulnerability details

Windows OLE Remote Code Execution Vulnerability

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.001 PowerShell Execution
Adversaries may abuse PowerShell commands and scripts for execution.
Why these techniques?

The CVE is a remote code execution vulnerability in a Windows component allowing unauthenticated network exploitation with no user interaction, directly mapping to T1190 for exploiting public-facing applications to gain initial access. Post-exploitation, the arbitrary code execution capability facilitates T1059.001 for running commands via PowerShell or similar interpreters.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-21307Same product: Microsoft Windows 10 1507
CVE-2025-50177Same product: Microsoft Windows 10 1507
CVE-2025-47986Same product: Microsoft Windows 10 1507
CVE-2025-21295Same product: Microsoft Windows 10 1507
CVE-2025-21296Same product: Microsoft Windows 10 1507
CVE-2025-24072Same product: Microsoft Windows 10 1507
CVE-2025-21406Same product: Microsoft Windows 10 1507
CVE-2025-21281Same product: Microsoft Windows 10 1507
CVE-2025-24044Same product: Microsoft Windows 10 1507
CVE-2025-24046Same product: Microsoft Windows 10 1507

Affected Assets

microsoft
windows 10 1507
≤ 10.0.10240.20890 · ≤ 10.0.10240.20890
microsoft
windows 10 1607
≤ 10.0.14393.7699 · ≤ 10.0.14393.7699
microsoft
windows 10 1809
≤ 10.0.17763.6775 · ≤ 10.0.17763.6775
microsoft
windows 10 21h2
≤ 10.0.19044.5371
microsoft
windows 10 22h2
≤ 10.0.19045.5371
microsoft
windows 11 22h2
≤ 10.0.22621.4751
microsoft
windows 11 23h2
≤ 10.0.22631.4751
microsoft
windows 11 24h2
≤ 10.0.26100.2894
microsoft
windows server 2008
all versions, r2
microsoft
windows server 2012
all versions, r2
+5 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

SI-2 mandates timely identification, reporting, and correction of system flaws, directly preventing exploitation of the Use After Free vulnerability in Windows OLE via vendor patches.

prevent

SI-16 implements memory protections like ASLR and DEP that directly mitigate use-after-free exploits such as CVE-2025-21298 by randomizing memory layouts and preventing code execution in data areas.

prevent

SC-7 monitors and controls communications at system boundaries to block unauthorized remote network access to the vulnerable Windows OLE component.

References