CVE-2025-21356
Published: 14 January 2025
Summary
CVE-2025-21356 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 23.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely patching of the specific heap-based buffer overflow vulnerability in Microsoft Office Visio to prevent exploitation via malicious files.
Implements memory protection safeguards such as ASLR and DEP that directly mitigate heap-based buffer overflow exploitation during Visio file parsing.
Deploys malicious code protection mechanisms like antivirus scanners to block or detect malicious Visio files before user interaction leads to RCE.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability is a client-side RCE in Visio triggered by opening a malicious file, directly enabling T1203 (Exploitation for Client Execution) and T1204.002 (Malicious File under User Execution).
NVD Description
Microsoft Office Visio Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21356 is a remote code execution vulnerability affecting Microsoft Office Visio. The issue stems from weaknesses mapped to CWE-122 (heap-based buffer overflow) and CWE-843 (access of resource using incompatible type), with additional NVD-CWE-noinfo classification. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on January 14, 2025.
An unprivileged attacker can exploit this vulnerability by tricking a user into opening a malicious Visio file on a local system, as it requires local attack vector, low complexity, no privileges, and user interaction. Successful exploitation grants high-impact remote code execution, compromising confidentiality, integrity, and availability on the targeted machine.
Microsoft's Security Response Center provides mitigation guidance in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21356, which security practitioners should consult for patching instructions and workarounds.
Details
- CWE(s)