CVE-2025-21363

CVE-2025-21363 is a remote code execution vulnerability in Microsoft Word. Published on 2025-01-14, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-822 (Untrusted Pointer Dereference) and NVD-CWE-noinfo.

An attacker can exploit this vulnerability with local access to the target system, low attack complexity, and no required privileges, but it necessitates user interaction such as opening a malicious document. Successful exploitation enables arbitrary code execution on the victim's machine, resulting in high impacts to confidentiality, integrity, and availability.

The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21363 provides details on patches and mitigation guidance.