CVE-2025-21298 : Windows OLE Remote Code Execution Vulnerability

CVE-2025-21298 is a critical zero-click vulnerability in Windows Object Linking and Embedding (OLE) technology, which enables embedding and linking to documents and objects.

This flaw, with a CVSS score of 9.8, allows remote code execution (RCE) through malicious emails containing specially crafted RTF documents.

The vulnerability is particularly severe because it requires no user interaction beyond opening or previewing the email in Microsoft Outlook.

The vulnerability resides in the ole32.dll library, specifically within the UtOlePresStmToContentsStm function. This function converts data in an “OlePres” stream into a “CONTENTS” stream within an OLE storage.

A coding flaw in this function leads to a double-free memory corruption issue. The problem arises when the pointer to the “CONTENTS” stream is freed but not reset to null, allowing it to be reused later in the function.

If an error occurs during processing, this can trigger a double-free scenario, leading to memory corruption and potential exploitation.

Attackers exploit this vulnerability by embedding malicious payloads in RTF files sent via email. When the recipient previews or opens the email, the vulnerability is triggered, allowing arbitrary code execution with the same privileges as the victim.

This could result in full system compromise, enabling attackers to install programs, modify or delete data, and create new accounts with elevated privileges.

Microsoft addressed this issue in its January 2025 Patch Tuesday updates by modifying the vulnerable function to reset the freed pointer to null, preventing reuse[8]. Users and organizations are strongly advised to:

• Apply Patches: Install the latest security updates immediately.
• Configure Email Clients: Set Outlook to read emails in plain text format to reduce risk.
• Monitor Activity: Use detection rules such as Sigma to identify suspicious interactions with RTF files.

For systems no longer receiving official updates, third-party micropatches are available to address this vulnerability.

Organizations should also train employees on recognizing phishing attempts and implement robust endpoint detection solutions for enhanced security.