CVE-2025-21361 is a high-severity vulnerability identified in Microsoft Office LTSC for Mac 2021, specifically affecting version 16.0.1. The vulnerability is categorized under CWE-641, which pertains to improper restriction of names for files and other resources. This flaw exists in Microsoft Outlook, a component of the Office suite, and can lead to remote code execution (RCE). The vulnerability arises because the application does not properly restrict or validate file or resource names, allowing an attacker to craft malicious input that can be processed by Outlook in a way that executes arbitrary code. The CVSS v3.1 base score is 7.8, indicating a high severity level. The vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RC:C) shows that the attack requires local access (AV:L), low attack complexity (AC:L), no privileges (PR:N), and user interaction (UI:R). The scope is unchanged (S:U), and the impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H). The exploit code is not currently known to be in the wild, but the vulnerability is publicly disclosed and could be targeted by attackers. The vulnerability could be exploited by tricking a user into opening a specially crafted file or resource within Outlook, leading to execution of malicious code with the privileges of the user. This could result in data theft, system compromise, or disruption of services.

For European organizations, this vulnerability poses a significant risk, especially those relying on Microsoft Office LTSC for Mac 2021 in their corporate environments. The high impact on confidentiality, integrity, and availability means that sensitive corporate data could be exposed or altered, and critical systems could be disrupted. Since the attack requires local access and user interaction, phishing or social engineering campaigns targeting employees could be effective vectors. Organizations handling sensitive personal data under GDPR could face regulatory and reputational consequences if exploited. The vulnerability could also facilitate lateral movement within networks if attackers gain initial footholds, potentially leading to broader compromises. Given the widespread use of Microsoft Office products in Europe, the threat could affect sectors such as finance, government, healthcare, and technology, where Mac devices are used and Outlook is a primary communication tool.

Organizations should prioritize patching Microsoft Office LTSC for Mac 2021 to the latest version once Microsoft releases an official fix. Until a patch is available, implement strict endpoint protection measures, including application whitelisting and behavior-based detection to identify suspicious activities related to Outlook. Educate users about the risks of opening unsolicited or suspicious files and emails, emphasizing the importance of verifying sender authenticity. Employ network segmentation to limit the impact of a potential compromise and restrict local access to critical systems. Use advanced email filtering solutions to detect and block malicious attachments or links. Additionally, monitor logs and endpoint telemetry for unusual behavior indicative of exploitation attempts. Consider deploying Mac-specific security tools that can detect exploitation of file handling vulnerabilities. Regularly review and update incident response plans to include scenarios involving local privilege escalation and remote code execution via email clients.