CVE-2025-21346
Published: 14 January 2025
Summary
CVE-2025-21346 is a high-severity Protection Mechanism Failure (CWE-693) vulnerability in Microsoft Office. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked in the top 45.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the Microsoft Office security feature bypass vulnerability through timely application of vendor-provided patches as advised by MSRC.
Malicious code protection scans Office files upon opening or download to block exploits requiring user interaction with malicious documents.
Enforces hardened configuration settings in Microsoft Office, such as Protected View and macro restrictions, to strengthen security features against bypass.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a security feature bypass in Microsoft Office exploited via user interaction with a malicious file (directly mapping to T1204.002 Malicious File); the description of tricking the user into opening such a file also plausibly facilitates delivery via T1566.001 Spearphishing Attachment.
NVD Description
Microsoft Office Security Feature Bypass Vulnerability
Deeper analysisAI
CVE-2025-21346 is a Security Feature Bypass Vulnerability affecting Microsoft Office. It has a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) and is associated with CWE-693 (Protection Mechanism Failure) along with NVD-CWE-noinfo.
The vulnerability can be exploited by an attacker with local access to the target system who tricks a user into performing an action, such as opening a malicious file, due to the low attack complexity and requirement for user interaction but no privileges. Successful exploitation allows the attacker to bypass security features, resulting in high integrity impact (I:H) and high availability impact (A:H), with no confidentiality impact (C:N).
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21346 provides guidance on mitigations and available patches.
Details
- CWE(s)