CVE-2025-21390

CVE-2025-21390 is a remote code execution vulnerability affecting Microsoft Excel. Published on 2025-02-11, it carries a CVSS 3.1 base score of 7.8, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and is associated with CWE-122 and NVD-CWE-noinfo.

An attacker with local access can exploit this vulnerability by tricking a user into performing an action, such as opening a malicious Excel file, with low attack complexity and no privileges required. Successful exploitation enables remote code execution, resulting in high impacts to confidentiality, integrity, and availability within the affected system.

The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21390 provides further details on the vulnerability, including recommended patches and mitigation steps.