CVE-2025-21298: Critical Windows OLE Zero-Click RCE Vulnerability

What is CVE-2025-21298?

CVE-2025-21298 is a critical remote code execution (RCE) vulnerability in Microsoft Windows’ Object Linking and Embedding (OLE) component. The flaw resides in the ole32.dll library, specifically within the UtOlePresStmToContentsStm function, which processes embedded OLE objects in Rich Text Format (RTF) files. A double-free condition in this function can be exploited to execute arbitrary code without user interaction. ​

Quick Facts

• CVE ID: CVE-2025-21298
• Severity: Critical
• CVSS Score: 9.8
• Attack Vector: Remote
• Privileges Required: None
• User Interaction: None (Zero-Click)
• Impact: Remote Code Execution

Who Should Be Concerned?

Organizations and individuals using the following Windows versions are at risk:​

• Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Windows 11 (versions 22H2, 23H2, 24H2)
• Windows Server (2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, 2025)​

Given the widespread use of Microsoft Outlook and Word, which can process RTF files, the potential impact is significant.​

Exploitation Details

An attacker can exploit this vulnerability by sending a specially crafted RTF file containing malicious OLE objects. When the victim previews or opens the file in applications like Microsoft Outlook or Word, the double-free condition is triggered, leading to memory corruption and potential code execution. Notably, this is a zero-click vulnerability; merely previewing the email is sufficient to trigger the exploit. ​

Potential Impact

Successful exploitation can result in:​

• Installation of malicious programs
• Unauthorized access to sensitive data
• Creation of new accounts with full user rights​.

The vulnerability has a CVSS score of 9.8, categorizing it as critical. ​

Vulnerability Timeline

• Discovery Date: January 2025
• Public Disclosure: January 2025
• Patch Release: January 2025​

Proof of Concept (PoC)

A proof-of-concept demonstrating the memory corruption issue has been published on GitHub. The PoC involves a crafted RTF file designed to trigger the double-free condition in the ole32.dll library.

rtf

{\rtf1
{\object\objhtml\objw1\objh1\objupdate\rsltpict
{\*\objclass None}
{\*\objdata 0105000002000000
0a000000
53746174696344696200
00000000
00000000
04000000
00000000
00000000
05000000
02000000
aa00
02000000
00000000
}
}}

This RTF content, when processed by vulnerable applications, can lead to memory corruption and potential code execution.​

Mitigation Strategies

• Apply Security Updates: Microsoft has released patches addressing this vulnerability. Ensure all systems are updated.
• Restrict RTF Processing: Limit the use of RTF files in email clients and consider converting emails to plain text.
• User Training: Educate users about the risks of opening unsolicited attachments.
• Implement Security Tools: Utilize antivirus and endpoint protection solutions that can detect and block malicious RTF files.​

Conclusion

CVE-2025-21298 poses a significant threat due to its zero-click nature and the availability of proof-of-concept code. Organizations must prioritize patching and implement defensive measures to mitigate the risk associated with this vulnerability.​

CVE-2025-21298 FAQs