CVE-2025-21387
Published: 11 February 2025
Summary
CVE-2025-21387 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked in the top 34.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the Use After Free vulnerability in Microsoft Excel by requiring timely application of vendor security updates as specified in the MSRC advisory.
Enforces secure baseline configuration settings for Excel, such as Protected View and disabled macros, to block opening of malicious files required for exploitation.
Deploys malicious code protection mechanisms to scan, detect, and prevent execution of Excel files exploiting the remote code execution vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a use-after-free in Microsoft Excel that triggers RCE upon opening a malicious Excel file (direct match to T1204.002 Malicious File). This is commonly delivered via email attachments in phishing campaigns (T1566.001 Spearphishing Attachment).
NVD Description
Microsoft Excel Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21387 is a Remote Code Execution vulnerability in Microsoft Excel. Published on 2025-02-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is linked to CWE-416 (Use After Free), with additional NVD-CWE-noinfo classification.
The vulnerability requires local access (AV:L), low attack complexity (AC:L), no privileges (PR:N), and user interaction (UI:R), such as opening a malicious Excel file. Attackers can exploit it to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), enabling remote code execution within the unchanged security scope (S:U).
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21387 provides guidance on mitigation, including available security updates for affected Microsoft Excel versions.
Details
- CWE(s)