CVE-2025-21326

CVE-2025-21326 is an Internet Explorer Remote Code Execution Vulnerability, published on 2025-01-14T18:15:57.170. It affects Internet Explorer and has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The vulnerability is associated with CWE-843 and NVD-CWE-noinfo.

The attack requires local access (AV:L) with low attack complexity (AC:L) and no privileges (PR:N), but user interaction is required (UI:R). A local attacker can exploit it by tricking the user into performing a specific action, such as interacting with a malicious webpage or file in Internet Explorer. Successful exploitation enables remote code execution in the context of the user, leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) with unchanged scope (S:U).

The Microsoft Security Response Center (MSRC) advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21326 provides details on the vulnerability, including recommended patches and mitigation steps.