CVE-2025-21364
Published: 14 January 2025
Summary
CVE-2025-21364 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Microsoft 365 Apps. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 47.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-3 (Malicious Code Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the deserialization flaw in Microsoft Excel by applying vendor-provided patches for this specific CVE.
Malicious code protection mechanisms scan and block malicious Excel files exploiting the deserialization vulnerability before user interaction.
Hardened configuration settings for Excel, such as enabling Protected View and disabling unsafe deserialization features, mitigate the security bypass.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a security feature bypass in Microsoft Excel triggered by deserialization of untrusted data in a malicious file; it is directly exploited when a user opens the crafted Excel file, mapping to Malicious File under User Execution.
NVD Description
Microsoft Excel Security Feature Bypass Vulnerability
Deeper analysisAI
CVE-2025-21364 is a Security Feature Bypass Vulnerability affecting Microsoft Excel. Published on January 14, 2025, it has a CVSS v3.1 base score of 7.8 (High), with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is associated with CWE-502 (Deserialization of Untrusted Data) and NVD-CWE-noinfo.
An attacker with local access can exploit this vulnerability with low attack complexity and no required privileges, but it requires user interaction. By tricking a user into performing a specific action, such as opening a malicious Excel file, the attacker can bypass security features, resulting in high impacts to confidentiality, integrity, and availability.
Microsoft's Security Response Center (MSRC) update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21364 provides details on mitigation, including available patches and recommended actions for affected systems.
Details
- CWE(s)