CVE-2025-21402 - Vulnerability Details - OpenCVE

Microsoft Office OneNote Remote Code Execution Vulnerability

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21402

History

Tue, 14 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 14 Jan 2025 18:15:00 +0000

Type	Values Removed	Values Added
Description		Microsoft Office OneNote Remote Code Execution Vulnerability
Title		Microsoft Office OneNote Remote Code Execution Vulnerability
Weaknesses		CWE-641
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21402
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2025-01-14T18:04:46.460Z

Updated: 2025-01-15T01:10:46.296Z

Reserved: 2024-12-11T00:29:48.375Z

Link: CVE-2025-21402

Vulnrichment

Updated: 2025-01-14T21:13:35.564Z

NVD

Status : Received

Published: 2025-01-14T18:16:04.190

Modified: 2025-01-14T18:16:04.190

Link: CVE-2025-21402

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-21402", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2024-12-11T00:29:48.375Z", "datePublished": "2025-01-14T18:04:46.460Z", "dateUpdated": "2025-01-15T01:10:46.296Z"}, "containers": {"cna": {"title": "Microsoft Office OneNote Remote Code Execution Vulnerability", "datePublic": "2025-01-14T08:00:00+00:00", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "16.93.25011212"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "16.93.25011212"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:onenote_for_mac:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "16.92.24120731"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2021", "platforms": ["Unknown"], "versions": [{"version": "16.0.1", "lessThan": "16.93.25011212", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2024", "platforms": ["Unknown"], "versions": [{"version": "1.0.0", "lessThan": "16.93.25011212", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft OneNote", "platforms": ["Unknown"], "versions": [{"version": "1.0.0", "lessThan": "16.92.24120731", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft Office OneNote Remote Code Execution Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-641: Improper Restriction of Names for Files and Other Resources", "lang": "en-US", "type": "CWE", "cweId": "CWE-641"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-15T01:10:46.296Z"}, "references": [{"name": "Microsoft Office OneNote Remote Code Execution Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21402"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-14T21:13:24.403697Z", "id": "CVE-2025-21402", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-14T21:13:44.512Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21402", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-14T21:13:24.403697Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-14T21:13:35.564Z"}}], "cna": {"title": "Microsoft Office OneNote Remote Code Execution Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2021", "versions": [{"status": "affected", "version": "16.0.1", "lessThan": "16.93.25011212", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2024", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "16.93.25011212", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft OneNote", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "16.92.24120731", "versionType": "custom"}], "platforms": ["Unknown"]}], "datePublic": "2025-01-14T08:00:00+00:00", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21402", "name": "Microsoft Office OneNote Remote Code Execution Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Microsoft Office OneNote Remote Code Execution Vulnerability"}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-641", "description": "CWE-641: Improper Restriction of Names for Files and Other Resources"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*", "vulnerable": true, "versionEndExcluding": "16.93.25011212", "versionStartIncluding": "16.0.1"}, {"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*", "vulnerable": true, "versionEndExcluding": "16.93.25011212", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:onenote_for_mac:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "16.92.24120731", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-14T23:52:55.143Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21402", "state": "PUBLISHED", "dateUpdated": "2025-01-14T23:52:55.143Z", "dateReserved": "2024-12-11T00:29:48.375Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2025-01-14T18:04:46.460Z", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}