CVE-2025-21298 - Use-After-Free in Windows OLE

CVSS Score: 9.8 | Impact: Remote Code Execution

1. Vulnerability Overview

CVE-2025-21298 is a critical Use-After-Free (UAF) vulnerability in the Windows OLE subsystem within ole32.dll. It allows remote code execution (RCE) via malicious RTF files or email previews in applications like Microsoft Outlook, requiring zero user interaction beyond viewing the email.

2. Technical Breakdown

Root Cause: Double-Free in UtOlePresStmToContentsStm

The function converts data between OLE streams, but mishandles memory freeing, leading to heap corruption.

// Cleanup code triggering double-free
if (pstmContents) 
    pstmContents->lpVtbl->Release(pstmContents); // Second free

Exploitation Mechanism: Attackers craft an RTF file with a malicious OLE object, triggering heap corruption and arbitrary code execution.

3. Reproduction Steps

Use an unpatched Windows system with Outlook/Word (pre-Jan 2025 updates).
Download poc.rtf and open it in a vulnerable application.
Attach WinDbg to observe access violations.

# Attach WinDbg to WINWORD.EXE or OUTLOOK.EXE
windbg.exe -pn WINWORD.EXE

4. Impact & Attack Scenarios

Zero-Click RCE: Exploitation via email preview in Outlook.
Privilege Escalation: Attacker gains execution at victim’s privilege level.
Lateral Movement: Attackers can pivot within internal networks and deploy ransomware.

5. Mitigation & Detection

Patching: Apply Microsoft’s January 2025 updates (e.g., KB5049981).
Workarounds: Block RTF attachments and disable email previews.
Detection: Use Sigma rules to monitor suspicious OLE activity.

title: Suspicious RTF File Execution
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    TargetFilename: '*.rtf'
  condition: selection

6. Patch Analysis

Microsoft’s fix ensures pstmContents is nullified after release:

+ IsEnabled = wil::details::FeatureImpl<__WilFeatureTraits_Feature_3047977275>::__private_IsEnabled(...);
+ if ( !IsEnabled )
+   pstmContents = 0LL; // Nullify dangling pointer

7. Conclusion

CVE-2025-21298 exemplifies the risks of legacy components like OLE. Due to its zero-click nature and exploitability, immediate patching and layered security defenses are critical.

References: