9.8
CRITICAL
CVE-2025-21298
Microsoft Windows OLE Remote Code Execution Vulnerability
Description

Windows OLE Remote Code Execution Vulnerability

INFO

Published Date :

Jan. 14, 2025, 6:15 p.m.

Last Modified :

Jan. 14, 2025, 6:15 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

3.9
Affected Products

The following products are affected by CVE-2025-21298 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Microsoft windows_server_2012
2 Microsoft windows_server_2016
3 Microsoft windows_server_2019
4 Microsoft windows_server_2022
5 Microsoft windows_11_22h2
6 Microsoft windows_server_2022_23h2
7 Microsoft windows_11_24h2
8 Microsoft windows_server_2025
: Total Affected Vendor : 1 | Products : 8
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-21298.

URL Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21298

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-21298 vulnerability anywhere in the article.

  • CrowdStrike.com
January 2025 Patch Tuesday: 10 Critical Vulnerabilities and Eight Zero-Days Among 159 CVEs

Microsoft has released security updates for 159 vulnerabilities in its January 2025 Patch Tuesday rollout. Among these are 10 Critical vulnerabilities and eight zero-days affecting the Windows Hyper-V ... Read more

Published Date: Jan 15, 2025 (1 hour, 31 minutes ago)
CVE-2025-21395 CVE-2025-21366 CVE-2025-21362 CVE-2025-21354 CVE-2025-21335 CVE-2025-21334 CVE-2025-21333 CVE-2025-21311 CVE-2025-21309 CVE-2025-21308 ...+8 more CVE
  • CrowdStrike.com
January 2025 Patch Tuesday: 10 Critical Vulnerabilities and Eight Zero-Days Among 159 CVEs

Microsoft has released security updates for 159 vulnerabilities in its January 2025 Patch Tuesday rollout. Among these are 10 Critical vulnerabilities and eight zero-days affecting the Windows Hyper-V ... Read more

Published Date: Jan 15, 2025 (3 hours, 31 minutes ago)
CVE-2025-21395 CVE-2025-21366 CVE-2025-21362 CVE-2025-21354 CVE-2025-21335 CVE-2025-21334 CVE-2025-21333 CVE-2025-21311 CVE-2025-21309 CVE-2025-21308 ...+8 more CVE
  • security.nl
Malafide e-mail maakt remote code execution via Microsoft Outlook mogelijk

Een kritieke kwetsbaarheid in Windows maakt remote code execution mogelijk als Outlook-gebruikers een speciaal geprepareerde e-mail openen of wanneer het bericht via de previewfunctie wordt weergegeve ... Read more

Published Date: Jan 15, 2025 (4 hours, 56 minutes ago)
CVE-2025-21298
  • CrowdStrike.com
January 2025 Patch Tuesday: 10 Critical Vulnerabilities and Eight Zero-Days Among 159 CVEs

Microsoft has released security updates for 159 vulnerabilities in its January 2025 Patch Tuesday rollout. Among these are 10 Critical vulnerabilities and eight zero-days affecting the Windows Hyper-V ... Read more

Published Date: Jan 15, 2025 (9 hours, 31 minutes ago)
CVE-2025-21395 CVE-2025-21366 CVE-2025-21362 CVE-2025-21354 CVE-2025-21335 CVE-2025-21334 CVE-2025-21333 CVE-2025-21311 CVE-2025-21309 CVE-2025-21308 ...+8 more CVE
  • The Hacker News
3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update

Microsoft kicked off 2025 with a new set of patches for a total of 161 security vulnerabilities across its software portfolio, including three zero-days that have been actively exploited in attacks. O ... Read more

Published Date: Jan 15, 2025 (12 hours, 37 minutes ago)
CVE-2025-21395 CVE-2025-21366 CVE-2025-21335 CVE-2025-21334 CVE-2025-21333 CVE-2025-21311 CVE-2025-21308 CVE-2025-21307 CVE-2025-21298 CVE-2025-21295 ...+7 more CVE
  • Cybersecurity News
Microsoft’s January 2025 Patch Tuesday Fixes 159 Vulnerabilities, Including 10 Critical and 8 Zero-Days

Microsoft delivers its first Patch Tuesday of 2025 with a robust security update addressing a wide range of vulnerabilities. With 159 issues patched, including 10 critical and 149 important ones, this ... Read more

Published Date: Jan 15, 2025 (16 hours, 4 minutes ago)
CVE-2025-21395 CVE-2025-21366 CVE-2025-21362 CVE-2025-21354 CVE-2025-21335 CVE-2025-21334 CVE-2025-21333 CVE-2025-21311 CVE-2025-21309 CVE-2025-21308 ...+9 more CVE
  • TheCyberThrone
Microsoft Patch Tuesday- January 2025

Microsoft released the January 2025 Patch Tuesday updates on January 14, 2025, focusing on addressing critical security vulnerabilities across various Microsoft products. This update cycle includes se ... Read more

Published Date: Jan 15, 2025 (16 hours, 9 minutes ago)
CVE-2025-21395 CVE-2025-21366 CVE-2025-21362 CVE-2025-21354 CVE-2025-21335 CVE-2025-21334 CVE-2025-21333 CVE-2025-21311 CVE-2025-21309 CVE-2025-21308 ...+9 more CVE
  • The Register
Microsoft fixes under-attack privilege-escalation holes in Hyper-V

Patch Tuesday The first Patch Tuesday of 2025 has seen Microsoft address three under-attack privilege-escalation flaws in its Hyper-V hypervisor, plus plenty more problems that deserve your attention. ... Read more

Published Date: Jan 15, 2025 (16 hours, 19 minutes ago)
CVE-2025-21362 CVE-2025-21354 CVE-2025-21335 CVE-2025-21334 CVE-2025-21333 CVE-2025-21311 CVE-2025-21309 CVE-2025-21307 CVE-2025-21298 CVE-2025-21297 ...+6 more CVE
  • Dark Reading
Microsoft Rings in 2025 With Record Security Update

Source: Elena11 via ShutterstockMicrosoft's January update contains patches for a record 159 vulnerabilities, including eight zero-day bugs, three of which attackers are already actively exploiting.Th ... Read more

Published Date: Jan 14, 2025 (18 hours, 56 minutes ago)
CVE-2025-21395 CVE-2025-21366 CVE-2025-21335 CVE-2025-21334 CVE-2025-21333 CVE-2025-21311 CVE-2025-21308 CVE-2025-21307 CVE-2025-21298 CVE-2025-21275 ...+1 more CVE
  • krebsonsecurity.com
Microsoft: Happy 2025. Here’s 161 Security Updates

Microsoft today unleashed updates to plug a whopping 161 security vulnerabilities in Windows and related software, including three “zero-day” weaknesses that are already under active attack. Redmond’s ... Read more

Published Date: Jan 14, 2025 (19 hours, 2 minutes ago)
CVE-2025-21395 CVE-2025-21366 CVE-2025-21335 CVE-2025-21334 CVE-2025-21333 CVE-2025-21311 CVE-2025-21298 CVE-2025-21210 CVE-2025-21186 CVE-2024-49142
  • The Cyber Express
Microsoft January 2025 Patch Tuesday: 8 Zero-Days, 3 Actively Exploited

Microsoft’s Patch Tuesday update for January 2025 patches 159 vulnerabilities, including eight zero-days, three of which are being actively exploited. The Microsoft January 2025 Patch Tuesday release ... Read more

Published Date: Jan 14, 2025 (19 hours, 43 minutes ago)
CVE-2025-21395 CVE-2025-21366 CVE-2025-21365 CVE-2025-21364 CVE-2025-21362 CVE-2025-21354 CVE-2025-21335 CVE-2025-21334 CVE-2025-21333 CVE-2025-21329 ...+21 more CVE
  • tripwire.com
VERT Threat Alert: January 2025 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s January 2025 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1139 as soon as coverage is completed.In ... Read more

Published Date: Jan 14, 2025 (20 hours, 44 minutes ago)
CVE-2024-50338 CVE-2025-21417 CVE-2025-21413 CVE-2025-21411 CVE-2025-21409 CVE-2025-21405 CVE-2025-21403 CVE-2025-21402 CVE-2025-21395 CVE-2025-21393 ...+151 more CVE
  • Help Net Security
Microsoft fixes actively exploited Windows Hyper-V zero-day flaws

Microsoft has marked January 2025 Patch Tuesday with a hefty load of patches: 157 CVE-numbered security issues have been fixed in various products, three of which (in Hyper-V) are being actively explo ... Read more

Published Date: Jan 14, 2025 (20 hours, 54 minutes ago)
CVE-2025-21395 CVE-2025-21366 CVE-2025-21335 CVE-2025-21334 CVE-2025-21333 CVE-2025-21298 CVE-2025-21210 CVE-2025-21186 CVE-2025-0282 CVE-2024-49142
  • BleepingComputer
Microsoft January 2025 Patch Tuesday fixes 8 zero-days, 159 flaws

Today is Microsoft's January 2025 Patch Tuesday, which includes security updates for 159 flaws, including eight zero-day vulnerabilities, with three actively exploited in attacks.This Patch Tuesday al ... Read more

Published Date: Jan 14, 2025 (22 hours, 51 minutes ago)
CVE-2024-50338 CVE-2025-21417 CVE-2025-21413 CVE-2025-21411 CVE-2025-21409 CVE-2025-21405 CVE-2025-21403 CVE-2025-21402 CVE-2025-21395 CVE-2025-21393 ...+152 more CVE

The following table lists the changes that have been made to the CVE-2025-21298 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by [email protected]

    Jan. 14, 2025

    Action Type Old Value New Value
    Added Description Windows OLE Remote Code Execution Vulnerability
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Added CWE CWE-416
    Added Reference https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21298
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-21298 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-21298 weaknesses.

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: