CVE-2025-24081
Published: 11 March 2025
Summary
CVE-2025-24081 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 43.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-24081 by requiring timely remediation and patching of the use-after-free flaw in Microsoft Office Excel.
Implements memory protection methods such as ASLR and DEP that directly counter use-after-free exploitation in Excel processes.
Deploys malicious code protection mechanisms to scan and block malicious Excel files or resulting code execution from this vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The use-after-free memory corruption vulnerability in Microsoft Excel directly enables arbitrary code execution upon opening a malicious file, mapping to Exploitation for Client Execution (T1203) as it targets a client application (office suite).
NVD Description
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Deeper analysisAI
CVE-2025-24081 is a use-after-free vulnerability (CWE-416) in Microsoft Office Excel. Published on 2025-03-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw enables an unauthorized attacker to execute code locally by exploiting memory corruption in Excel's handling of objects after they have been freed.
An attacker with local access to the target system, requiring no privileges (PR:N), can exploit this vulnerability with low complexity (AC:L) but needs user interaction (UI:R), such as convincing a user to open a malicious Excel file. Successful exploitation leads to arbitrary code execution in the context of the Excel process, granting high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).
Microsoft's Security Response Center provides an update guide for mitigation at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24081, detailing patches and recommended actions for affected systems.
Details
- CWE(s)