CVE-2025-21298

Microsoft · Published January 14, 2025

9.8

CVSS v3.1

CRITICAL

Patch availableGet patch

Description

Windows OLE remote code execution via specially crafted Rich Text Format (RTF) emails. Opening or previewing the email in Outlook triggers the vulnerability without user interaction beyond email receipt.

Affected Products

Windows 10/11 (all versions)
Windows Server 2016/2019/2022/2025
Microsoft Outlook (all current versions)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Related Advisories

NEWSCRITICALCVE-2025-21298

January 2025 Patch Tuesday: 8 Zero-Days, 3 Critical — What to Prioritize

Microsoft's January 2025 Patch Tuesday addressed 159 vulnerabilities including 8 zero-days (3 exploited in the wild) and critical RCE flaws in Windows OLE, LDAP, and Hyper-V.

WHY IT MATTERS

Three actively exploited zero-days including a SYSTEM-level Hyper-V escalation — apply this month's patches before end of week.

MicrosoftWindowsPatch Management+1 more

Jan 14, 2025· 4 min read