CVE-2025-21364

CVE-2025-21364 is a Security Feature Bypass Vulnerability affecting Microsoft Excel. Published on January 14, 2025, it has a CVSS v3.1 base score of 7.8 (High), with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is associated with CWE-502 (Deserialization of Untrusted Data) and NVD-CWE-noinfo.

An attacker with local access can exploit this vulnerability with low attack complexity and no required privileges, but it requires user interaction. By tricking a user into performing a specific action, such as opening a malicious Excel file, the attacker can bypass security features, resulting in high impacts to confidentiality, integrity, and availability.

Microsoft's Security Response Center (MSRC) update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21364 provides details on mitigation, including available patches and recommended actions for affected systems.