CVE-2025-21381
Published: 11 February 2025
Summary
CVE-2025-21381 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 37.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-3 (Malicious Code Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely patching of Microsoft Excel to remediate the specific RCE flaw.
Deploys anti-malware tools to scan and block malicious Excel files exploiting the RCE vulnerability before execution.
Enforces secure configuration settings in Excel, such as mandatory Protected View and disabled macros, to reduce exploitation risk.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a client-side RCE in Microsoft Excel triggered by opening a malicious file with user interaction, directly enabling T1203 (Exploitation for Client Execution) and T1204.002 (User Execution: Malicious File).
NVD Description
Microsoft Excel Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21381 is a Remote Code Execution vulnerability in Microsoft Excel. Published on 2025-02-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-822 and NVD-CWE-noinfo.
The vulnerability can be exploited by an attacker with local access who tricks a user into performing an action, such as opening a malicious Excel file, given the low attack complexity and requirement for user interaction but no privileges. Successful exploitation enables remote code execution in the context of the user, resulting in high impacts to confidentiality, integrity, and availability.
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21381.
Details
- CWE(s)