CVE-2025-21365

CVE-2025-21365 is a remote code execution vulnerability affecting Microsoft Office. Published on 2025-01-14T18:16:02.310, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is linked to CWE-426 (Untrusted Search Path) as well as NVD-CWE-noinfo.

The vulnerability can be exploited by an attacker who tricks a user into opening a malicious Office document on a local system. Exploitation requires local access, low attack complexity, no privileges, and user interaction, but results in high-impact code execution that compromises confidentiality, integrity, and availability with unchanged scope.

Microsoft's advisory provides mitigation guidance via the update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21365.