CVE-2025-21394

CVE-2025-21394 is a Remote Code Execution vulnerability affecting Microsoft Excel. Published on 2025-02-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-416 (Use After Free), though additional CWE details are unavailable from NVD.

The vulnerability can be exploited by a local attacker with low complexity and no required privileges, provided they can induce user interaction, such as opening a malicious Excel file. Successful exploitation allows arbitrary code execution in the context of the user, resulting in high impacts to confidentiality, integrity, and availability.

For mitigation details, refer to the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21394.