CVE-2025-21397: Microsoft 365 Apps RCE Vulnerability

CVE-2025-21397 Overview

CVE-2025-21397 is a remote code execution vulnerability affecting Microsoft Office, including Microsoft 365 Apps and the Office Long Term Servicing Channel (LTSC) 2021 and 2024. The flaw stems from a use-after-free condition [CWE-416] in Office document processing. An attacker who successfully exploits the vulnerability can execute arbitrary code in the context of the current user. Exploitation requires user interaction, meaning a victim must open a crafted Office document. Microsoft addressed the issue in its February 2025 Patch Tuesday release.

Critical Impact
Successful exploitation allows arbitrary code execution under the logged-on user's privileges, enabling malware installation, data theft, and lateral movement from a single opened document.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Office Long Term Servicing Channel 2021
Microsoft Office Long Term Servicing Channel 2024

Discovery Timeline

2025-02-11 - CVE-2025-21397 published to NVD
2025-02-11 - Microsoft releases security update via the February Patch Tuesday cycle
2025-07-01 - Last updated in NVD database

Technical Details for CVE-2025-21397

Vulnerability Analysis

The vulnerability is classified as a use-after-free condition [CWE-416] within Microsoft Office. Use-after-free flaws occur when an application continues to reference memory after it has been released. An attacker can manipulate the freed memory region to control program flow and execute arbitrary instructions. The attack vector is local, but the practical delivery mechanism is a malicious document delivered through email, web download, or shared storage. User interaction is required to trigger the vulnerable code path, typically by opening a crafted file in an affected Office application. The EPSS probability for this CVE is 0.349%.

Root Cause

The underlying defect is improper memory lifecycle management within an Office component. When a specific object is freed but a dangling reference remains, subsequent operations on that reference allow an attacker to influence memory contents. Microsoft has not published full technical specifics, classifying the issue under [CWE-416] in line with the advisory.

Attack Vector

An attacker crafts a malicious Office document and delivers it to a target user through phishing or another social engineering channel. When the user opens the document in a vulnerable version of Microsoft 365 Apps or Office LTSC, the use-after-free is triggered. The resulting code runs with the privileges of the logged-on user. If the user holds administrative rights, the attacker gains full control of the host.

No public proof-of-concept exploit is available, and CISA has not added CVE-2025-21397 to the Known Exploited Vulnerabilities catalog. Defenders should still treat document-borne RCE flaws in Office as high-priority because they are commonly weaponized after patch disclosure. Refer to the Microsoft Security Response Center advisory for vendor-supplied details.

Detection Methods for CVE-2025-21397

Indicators of Compromise

Unexpected child processes spawned by winword.exe, excel.exe, powerpnt.exe, or outlook.exe, particularly cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Office applications writing executable content to user-writable paths such as %TEMP%, %APPDATA%, or %PUBLIC%.
Outbound network connections initiated directly from Office processes to uncategorized or newly registered domains.
Crash events or abnormal termination of Office processes logged in the Windows Application event log shortly after a document is opened.

Detection Strategies

Hunt for Office process ancestry anomalies where Office applications launch scripting interpreters or LOLBins.
Inspect inbound email attachments for Office documents containing embedded objects, macros, or external references.
Correlate Office crash telemetry with subsequent process creation events to identify exploitation attempts that fail.
Use behavioral analytics to flag deviations from baseline Office process behavior on managed endpoints.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and executable content.
Forward Office telemetry, Sysmon process creation events (Event ID 1), and EDR alerts to a centralized SIEM for correlation.
Monitor endpoints running Office LTSC 2021 and 2024 builds that have not been updated to the February 2025 patch level.
Track DNS and proxy logs for anomalous lookups originating from Office processes after document open events.

How to Mitigate CVE-2025-21397

Immediate Actions Required

Apply the February 2025 Microsoft security updates for Microsoft 365 Apps and Office LTSC 2021 and 2024 across all endpoints.
Prioritize patching for high-risk users including executives, finance, HR, and IT administrators who routinely receive external documents.
Verify update deployment status through Microsoft Configuration Manager, Intune, or your patch management platform.
Restrict local administrator rights so that exploitation does not yield SYSTEM-level access.

Patch Information

Microsoft published the official fix in the MSRC advisory for CVE-2025-21397. Administrators should consult the advisory for the exact build numbers corresponding to each Office channel and confirm that Click-to-Run or MSI updates have applied successfully. Validate the installed build version using File > Account > About within any Office application.

Workarounds

Enable Protected View and Office Application Guard so that untrusted documents are opened in an isolated container.
Block macros in documents from the internet using the Group Policy setting Block macros from running in Office files from the Internet.
Configure ASR rules including Block all Office applications from creating child processes and Block Office applications from creating executable content.
Use email gateways to strip or sandbox Office attachments from external senders pending patch deployment.

bash

# Example: Enable ASR rule to block Office child process creation via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify Office build version after patching
reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v VersionToReport