CVE-2025-21345: Microsoft 365 Apps RCE Vulnerability

CVE-2025-21345 Overview

CVE-2025-21345 is a remote code execution vulnerability affecting Microsoft Office Visio, a diagramming and vector graphics application within the Microsoft Office suite. This use-after-free vulnerability allows attackers to execute arbitrary code on vulnerable systems when a user opens a specially crafted Visio file.

The vulnerability stems from improper memory handling within the Visio application, where an object in memory is accessed after it has been freed. Successful exploitation requires user interaction—specifically, convincing a target to open a malicious Visio document. Once triggered, an attacker could execute code with the same privileges as the current user.

Critical Impact

Successful exploitation allows remote code execution with user-level privileges, potentially leading to complete system compromise if the user has administrative rights.

Affected Products

• Microsoft 365 Apps for Enterprise (x86 and x64)
• Microsoft Office 2019 (x86 and x64)
• Microsoft Office Long Term Servicing Channel 2021 and 2024 (x86 and x64)

Discovery Timeline

• 2025-01-14 - CVE-2025-21345 published to NVD
• 2025-07-01 - Last updated in NVD database

Technical Details for CVE-2025-21345

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption issue that occurs when an application continues to use a pointer to memory after it has been freed. In the context of Microsoft Visio, this flaw exists in how the application processes certain elements within Visio document files.

Use-after-free vulnerabilities are particularly dangerous because they can lead to arbitrary code execution. When memory is freed and subsequently reallocated, an attacker who can control the contents of the reallocated memory can potentially hijack program execution flow. The local attack vector indicates that exploitation requires the malicious file to be present on the target system or accessible via a network share, with user interaction required to open the document.

Root Cause

The root cause of CVE-2025-21345 lies in improper memory management within Microsoft Office Visio's file parsing engine. Specifically, the application fails to properly validate or nullify references to memory objects after they are deallocated. This creates a dangling pointer condition where subsequent code paths may attempt to access or manipulate the freed memory region.

When processing specially crafted Visio files (.vsd, .vsdx, or related formats), the parser may trigger a sequence where an object is freed prematurely while other components still maintain references to it. An attacker can exploit this timing issue by crafting file structures that force the allocation of attacker-controlled data into the freed memory space.

Attack Vector

Exploitation of CVE-2025-21345 requires local access and user interaction. The attack typically follows this pattern:

1. Delivery: An attacker delivers a malicious Visio file to the target through email, file sharing, or download
2. Social Engineering: The victim is convinced to open the malicious document
3. Trigger: Upon opening, the crafted file elements trigger the use-after-free condition
4. Code Execution: The attacker's payload executes with the privileges of the Visio process

The vulnerability requires no special privileges for exploitation, but does require the user to actively open the malicious file. Attack complexity is considered low once the file reaches the target, as no additional conditions need to be met for exploitation.

Detection Methods for CVE-2025-21345

Indicators of Compromise

• Unexpected crashes or abnormal behavior of Microsoft Visio (visio.exe) processes
• Suspicious child processes spawned by visio.exe that are atypical for normal diagramming workflows
• Unusual Visio files (.vsd, .vsdx, .vsdm) arriving via email or external sources with unfamiliar origins
• Memory access violations or exception logs related to Visio in Windows Event logs

Detection Strategies

• Monitor for anomalous process creation events where visio.exe spawns unexpected child processes (e.g., cmd.exe, powershell.exe, or scripting hosts)
• Implement email filtering rules to quarantine and scan Visio attachments from external or untrusted sources
• Deploy endpoint detection and response (EDR) solutions capable of detecting memory corruption exploitation techniques
• Enable Windows Defender Exploit Guard with Export Address Filtering (EAF) and Import Address Filtering (IAF) mitigations

Monitoring Recommendations

• Configure SIEM rules to alert on multiple Visio application crashes within short time periods
• Monitor for Visio files with unusual metadata or structural anomalies using file inspection tools
• Track document open events correlated with suspicious network connections or process behavior
• Enable detailed logging for Microsoft Office applications to capture potential exploitation attempts

How to Mitigate CVE-2025-21345

Immediate Actions Required

• Apply the latest security updates from Microsoft for all affected Office products immediately
• Instruct users to avoid opening Visio files from untrusted or unknown sources until patches are applied
• Implement network-level filtering to block or quarantine Visio file attachments from external email sources
• Enable Protected View settings in Microsoft Office to open potentially dangerous files in a sandboxed environment

Patch Information

Microsoft has released security updates to address this vulnerability. Organizations should apply patches through Windows Update, Microsoft Update Catalog, or enterprise deployment tools such as WSCCM or Intune. Detailed patch information and download links are available in the Microsoft Security Response Center advisory.

For Microsoft 365 Apps, ensure automatic updates are enabled or deploy updates through your organization's update channel. For perpetual Office installations (Office 2019, LTSC 2021, LTSC 2024), download and apply the appropriate cumulative update package.

Workarounds

• Enable Protected View for files originating from the Internet in Trust Center settings (File > Options > Trust Center > Protected View)
• Configure Application Guard for Office if available in your environment to isolate potentially malicious documents
• Restrict the ability to open Visio files directly from email clients by requiring users to save files locally first
• Consider temporarily disabling Visio if not business-critical until patches can be deployed

# PowerShell: Enable Protected View settings via registry for all Office applications
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Common\Security\ProtectedView" -Name "DisableAttachmentsInPV" -Value 0 -PropertyType DWORD -Force
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Common\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value 0 -PropertyType DWORD -Force
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Common\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value 0 -PropertyType DWORD -Force