CVE-2025-21362

CVE-2025-21362 is a remote code execution vulnerability affecting Microsoft Excel. It stems from a use-after-free error (CWE-416) and carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on January 14, 2025.

An attacker with local access to the target system can exploit this vulnerability with low complexity and no required privileges or user interaction. Successful exploitation allows the attacker to achieve high-impact remote code execution, potentially compromising confidentiality, integrity, and availability by executing arbitrary code in the context of the Excel process.

Microsoft's Security Response Center provides detailed guidance and patch information in their update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21362, recommending affected users apply the available security updates to mitigate the issue.