CVE-2025-21366

CVE-2025-21366 is a Remote Code Execution vulnerability affecting Microsoft Access. Published on 2025-01-14, it is linked to CWE-416 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact with local attack vector, low complexity, no privileges required, and user interaction needed.

An attacker with local access can exploit this vulnerability by tricking a user into interacting with a malicious Access file or database, such as opening it. Successful exploitation enables remote code execution, granting high confidentiality, integrity, and availability impacts on the affected system.

Microsoft provides mitigation guidance in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21366.