CVE-2025-21392
Published: 11 February 2025
Summary
CVE-2025-21392 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 42.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21392 is a remote code execution vulnerability in Microsoft Office, published on 2025-02-11. It stems from CWE-416 (Use After Free) with additional NVD-CWE-noinfo classification and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Exploitation requires local access vector with low attack complexity and no privileges, but user interaction is necessary. A threat actor can leverage this to execute arbitrary code on the target system, resulting in high impacts to confidentiality, integrity, and availability.
Microsoft provides mitigation details, including patches, in its Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21392.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2453
Vulnerability details
Microsoft Office Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE vulnerability in Microsoft Office via use-after-free requires user interaction to open malicious file, directly enabling client-side exploitation and malicious file execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely installation of Microsoft patches to remediate the Use After Free vulnerability in Office, directly preventing exploitation.
Implements memory safeguards such as DEP and ASLR that protect against unauthorized code execution from Use After Free flaws.
Enables vulnerability scanning to identify CVE-2025-21392 in Microsoft Office systems, supporting prioritization for patching.