CVE-2025-21386
Published: 11 February 2025
Summary
CVE-2025-21386 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 42.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-3 (Malicious Code Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the use-after-free vulnerability in Microsoft Excel by requiring timely application of vendor-provided patches.
Deploys anti-malware tools to scan and block malicious Excel files or detect anomalous code execution during file opening.
Implements memory protections like ASLR and DEP to mitigate exploitation of the CWE-416 use-after-free flaw even if unpatched.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Client-side RCE in Excel triggered by opening malicious file directly maps to exploitation for client execution (T1203) and user execution via malicious file (T1204.002).
NVD Description
Microsoft Excel Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21386 is a Remote Code Execution vulnerability in Microsoft Excel. Published on 2025-02-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is linked to CWE-416, with additional NVD-CWE-noinfo classification.
Exploitation requires local access to the target system, low attack complexity, no privileges from the attacker, and user interaction, such as opening a malicious Excel file. Successful exploitation allows an attacker to achieve high impacts on confidentiality, integrity, and availability, enabling remote code execution on the affected machine.
Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21386 details mitigation steps, including available patches through standard update channels.
Details
- CWE(s)