CVE-2025-21326
Published: 14 January 2025
Summary
CVE-2025-21326 is a high-severity Type Confusion (CWE-843) vulnerability in Microsoft Windows Server 2022 23H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 26.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21326 is an Internet Explorer Remote Code Execution Vulnerability, published on 2025-01-14T18:15:57.170. It affects Internet Explorer and has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The vulnerability is associated with CWE-843 and NVD-CWE-noinfo.
The attack requires local access (AV:L) with low attack complexity (AC:L) and no privileges (PR:N), but user interaction is required (UI:R). A local attacker can exploit it by tricking the user into performing a specific action, such as interacting with a malicious webpage or file in Internet Explorer. Successful exploitation enables remote code execution in the context of the user, leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) with unchanged scope (S:U).
The Microsoft Security Response Center (MSRC) advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21326 provides details on the vulnerability, including recommended patches and mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2391
Vulnerability details
Internet Explorer Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE is an RCE vulnerability in the Internet Explorer client application requiring user interaction with a malicious webpage or file, directly mapping to Exploitation for Client Execution (T1203) and User Execution via malicious link/file (T1204.001/T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the Internet Explorer RCE vulnerability by requiring timely installation of Microsoft patches as specified in the MSRC advisory.
Eliminates exposure to this and similar vulnerabilities by prohibiting, replacing, or additionally controlling unsupported Internet Explorer components.
Provides memory protections like DEP and ASLR that hinder successful remote code execution even if the vulnerability is triggered.