CVE-2025-21345
Published: 14 January 2025
Summary
CVE-2025-21345 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 23.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the Use After Free vulnerability by requiring timely installation of Microsoft patches for affected Visio versions.
Implements memory safeguards such as DEP and ASLR to protect against code execution exploits stemming from the Visio Use After Free flaw.
Deploys malicious code protection to scan and block malicious Visio files that could trigger the remote code execution vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
This client-side RCE vulnerability in Microsoft Visio requires user interaction to open a malicious file (UI:R, AV:L) and directly enables arbitrary code execution, mapping to Exploitation for Client Execution (T1203) and User Execution via Malicious File (T1204.002).
NVD Description
Microsoft Office Visio Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21345 is a Remote Code Execution vulnerability affecting Microsoft Office Visio. Published on 2025-01-14, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-416 (Use After Free), though additional CWE details are unavailable from NVD.
The vulnerability can be exploited by an attacker with local access to the target system, requiring low attack complexity, no privileges, and user interaction. A successful exploit allows the attacker to achieve high-impact remote code execution, compromising confidentiality, integrity, and availability on the affected system.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21345 provides details on mitigation, including available patches.
Details
- CWE(s)