CVE-2025-21394
Published: 11 February 2025
Summary
CVE-2025-21394 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked in the top 42.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the Use After Free vulnerability in Microsoft Excel through timely application of vendor-provided patches.
Implements memory protections such as ASLR and DEP to mitigate exploitation of the Use After Free flaw during Excel file processing.
Deploys malicious code protection mechanisms to scan and block malicious Excel files prior to user interaction and execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a client-side RCE in Excel triggered by opening a malicious file with user interaction, directly enabling T1204.002 (Malicious File under User Execution) and facilitating T1566.001 (Spearphishing Attachment) as a common delivery vector for such files.
NVD Description
Microsoft Excel Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21394 is a Remote Code Execution vulnerability affecting Microsoft Excel. Published on 2025-02-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-416 (Use After Free), though additional CWE details are unavailable from NVD.
The vulnerability can be exploited by a local attacker with low complexity and no required privileges, provided they can induce user interaction, such as opening a malicious Excel file. Successful exploitation allows arbitrary code execution in the context of the user, resulting in high impacts to confidentiality, integrity, and availability.
For mitigation details, refer to the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21394.
Details
- CWE(s)