CVE-2025-21363
Published: 14 January 2025
Summary
CVE-2025-21363 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 18.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-3 (Malicious Code Protection).
Deeper analysis
Microsoft Word contains a remote code execution vulnerability tracked as CVE-2025-21363. The flaw affects the Microsoft Word application and carries a CVSS 3.1 base score of 7.8, reflecting local attack vector, low attack complexity, no privileges required, and required user interaction, with high impact on confidentiality, integrity, and availability. The issue is associated with CWE-822.
An attacker can exploit the vulnerability by supplying a specially crafted file that a user opens in Microsoft Word. Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the current user, potentially leading to full control over affected documents and system resources.
Microsoft has published guidance for the vulnerability in its Security Response Center update guide. The EPSS score remains low, with a current value of 0.0154 and a recorded peak of 0.0195, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2426
Vulnerability details
Microsoft Word Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in Microsoft Word client application allows arbitrary code execution upon opening a malicious document, directly enabling T1203 (Exploitation for Client Execution) and T1204.002 (Malicious File under User Execution).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation through vendor patches directly eliminates the untrusted pointer dereference vulnerability in Microsoft Word.
Malicious code protection scans and blocks malicious Word documents exploiting the vulnerability before arbitrary code execution.
Memory protection safeguards prevent unauthorized code execution resulting from untrusted pointer dereferences in malicious documents.