CVE-2025-21366
Published: 14 January 2025
Summary
CVE-2025-21366 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 16.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates timely flaw remediation, directly preventing exploitation by applying Microsoft patches for this specific Access RCE vulnerability.
SI-16 enforces memory protections like ASLR, DEP, and canaries that comprehensively mitigate use-after-free (CWE-416) exploitation attempts.
SI-3 deploys malicious code protection to scan Access files for threats and detect behavioral indicators of RCE during file opening.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a client-side RCE in Microsoft Access triggered when a user opens a malicious file/database, directly mapping to T1203 (Exploitation for Client Execution) and T1204.002 (Malicious File).
NVD Description
Microsoft Access Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21366 is a Remote Code Execution vulnerability affecting Microsoft Access. Published on 2025-01-14, it is linked to CWE-416 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact with local attack vector, low complexity, no privileges required, and user interaction needed.
An attacker with local access can exploit this vulnerability by tricking a user into interacting with a malicious Access file or database, such as opening it. Successful exploitation enables remote code execution, granting high confidentiality, integrity, and availability impacts on the affected system.
Microsoft provides mitigation guidance in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21366.
Details
- CWE(s)