CVE-2025-21387

CVE-2025-21387 is a Remote Code Execution vulnerability in Microsoft Excel. Published on 2025-02-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is linked to CWE-416 (Use After Free), with additional NVD-CWE-noinfo classification.

The vulnerability requires local access (AV:L), low attack complexity (AC:L), no privileges (PR:N), and user interaction (UI:R), such as opening a malicious Excel file. Attackers can exploit it to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), enabling remote code execution within the unchanged security scope (S:U).

The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21387 provides guidance on mitigation, including available security updates for affected Microsoft Excel versions.