CVE-2025-21365
Published: 14 January 2025
Summary
CVE-2025-21365 is a high-severity Untrusted Search Path (CWE-426) vulnerability in Microsoft 365 Apps. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked in the top 30.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-3 (Malicious Code Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the vulnerability by requiring timely patching of Microsoft Office to remediate the untrusted search path flaw.
Deploys anti-malware tools to scan and prevent execution of malicious Office documents exploiting the untrusted search path.
Enforces secure configuration settings for Microsoft Office, such as safe DLL search mode, to restrict loading from untrusted paths.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is exploited by tricking a user into opening a malicious Office document, which directly maps to T1204.002 Malicious File and results in RCE.
NVD Description
Microsoft Office Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21365 is a remote code execution vulnerability affecting Microsoft Office. Published on 2025-01-14T18:16:02.310, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is linked to CWE-426 (Untrusted Search Path) as well as NVD-CWE-noinfo.
The vulnerability can be exploited by an attacker who tricks a user into opening a malicious Office document on a local system. Exploitation requires local access, low attack complexity, no privileges, and user interaction, but results in high-impact code execution that compromises confidentiality, integrity, and availability with unchanged scope.
Microsoft's advisory provides mitigation guidance via the update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21365.
Details
- CWE(s)