CVE-2025-21338
Published: 14 January 2025
Summary
CVE-2025-21338 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Microsoft Office. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 27.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21338 is a GDI+ Remote Code Execution vulnerability, published on 2025-01-14, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It is associated with CWE-190 and affects the GDI+ graphics component in Microsoft Windows systems.
The vulnerability can be exploited by a local attacker who has low privileges on the target system. Exploitation requires low complexity and no user interaction, allowing the attacker to execute arbitrary code in the context of the affected process, with high impacts on confidentiality, integrity, and availability.
Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21338 provides details on patches and mitigation steps for addressing this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2403
Vulnerability details
GDI+ Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local arbitrary code execution vulnerability (integer overflow in GDI+) in a client graphics component, directly enabling exploitation for code execution in client applications without user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the GDI+ RCE vulnerability by requiring timely identification, reporting, and patching of the specific flaw as detailed in Microsoft's advisory.
Implements memory protection technologies like ASLR and DEP that directly counter memory corruption exploits such as the CWE-190 integer overflow in GDI+ leading to RCE.
Enforces least privilege to limit the scope and impact of arbitrary code execution by a low-privileged local attacker exploiting the GDI+ vulnerability.