CVE-2025-21392

CVE-2025-21392 is a remote code execution vulnerability in Microsoft Office, published on 2025-02-11. It stems from CWE-416 (Use After Free) with additional NVD-CWE-noinfo classification and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Exploitation requires local access vector with low attack complexity and no privileges, but user interaction is necessary. A threat actor can leverage this to execute arbitrary code on the target system, resulting in high impacts to confidentiality, integrity, and availability.

Microsoft provides mitigation details, including patches, in its Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21392.