CVE-2025-21298: Windows OLE use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no privileges or user interaction, and very high EPSS make this a top patching priority despite no KEV listing.

What it is

CVE-2025-21298 is a use-after-free flaw in Windows OLE that permits remote code execution. It affects a broad range of Windows client and server releases, and the vendor has published a patch. Because the flaw is memory-corruption based and reachable over the network, it is a serious risk to unpatched systems.

Impact

A successful attacker can execute arbitrary code in the context of the affected process, potentially leading to full system compromise. Given the CVSS impact ratings, confidentiality, integrity and availability are all fully impacted.

Attack surface

The CVSS vector indicates network reachability with no privileges and no user interaction required, so the flaw may be triggered by crafted input delivered over the network. The description does not specify the exact protocol or component, so the precise entry point is not detailed in the record.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit references, but EPSS is very high at roughly 0.81 (99.6th percentile), indicating elevated likelihood of exploitation activity. No ransomware usage is documented.

What to do

• Apply the Microsoft security update referenced in the vendor advisory as soon as possible.
• Prioritize patching internet-facing and high-value Windows servers and workstations.
• Restrict unnecessary network exposure of OLE-related services and block untrusted input paths where feasible.
• Monitor vendor guidance for any additional workarounds or mitigations.
• Inventory all affected Windows versions listed in the advisory to confirm coverage.

Detection

• Monitor for unexpected process crashes or memory corruption events in OLE-related Windows components.
• Alert on suspicious child processes spawned by Office or OLE host processes.
• Review network traffic for anomalous payloads targeting Windows OLE services.
• Correlate endpoint telemetry for use-after-free exploitation patterns such as repeated crashes followed by code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.