CVE-2025-21354

CVE-2025-21354 is a Remote Code Execution vulnerability in Microsoft Excel. Published on 2025-01-14, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-822 (Untrusted Pointer Dereference) along with NVD-CWE-noinfo.

The vulnerability can be exploited by a local attacker requiring low complexity, no privileges, and no user interaction. Successful exploitation enables the attacker to execute arbitrary code with high impacts on confidentiality, integrity, and availability within the affected Excel instance.

The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21354 provides details on mitigation, including available patches and recommended actions for security practitioners.