CVE-2025-21402

CVE-2025-21402 is a Remote Code Execution vulnerability in Microsoft Office OneNote. Published on January 14, 2025, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-641 and NVD-CWE-noinfo.

The vulnerability requires local access (AV:L), low attack complexity (AC:L), no privileges (PR:N), and user interaction (UI:R), such as opening a malicious file. An attacker who can convince a user to interact with a specially crafted OneNote document can achieve remote code execution, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) within the affected scope (S:U).

Microsoft's advisory on the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21402 provides details on mitigation, including available patches and security updates for affected OneNote versions.