CVE-2025-21390
Published: 11 February 2025
Summary
CVE-2025-21390 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 42.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely patching of the Microsoft Excel flaw exploited by CVE-2025-21390 to prevent remote code execution from malicious files.
Deploys malicious code protection mechanisms to scan and block malicious Excel files attempting to exploit CVE-2025-21390 before execution.
Mandates secure configuration settings for Microsoft Excel, such as Protected View and disabled macros, to mitigate user-triggered exploitation of CVE-2025-21390.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a client-side RCE in Microsoft Excel triggered by opening a malicious file with user interaction, directly mapping to Exploitation for Client Execution (T1203) and User Execution via Malicious File (T1204.002).
NVD Description
Microsoft Excel Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21390 is a remote code execution vulnerability affecting Microsoft Excel. Published on 2025-02-11, it carries a CVSS 3.1 base score of 7.8, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and is associated with CWE-122 and NVD-CWE-noinfo.
An attacker with local access can exploit this vulnerability by tricking a user into performing an action, such as opening a malicious Excel file, with low attack complexity and no privileges required. Successful exploitation enables remote code execution, resulting in high impacts to confidentiality, integrity, and availability within the affected system.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21390 provides further details on the vulnerability, including recommended patches and mitigation steps.
Details
- CWE(s)