Windows OLE Zero-Click RTF RCE
- Product
- Microsoft Windows OLE (ole32.dll)
- CVE
- CVE-2025-21298
- Disclosed
- 2025-01-14
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- All supported Windows client and server versions before January 2025 updates.
- Fixed
- January 2025 Patch Tuesday cumulative updates.
Summary
A double-free in Windows OLE that can be triggered just by previewing a crafted RTF email in Outlook. No click is needed beyond the message being rendered in the Preview Pane.
Root cause
ole32.dll's UtOlePresStmToContentsStm converts an 'OlePres' stream in an embedded OLE storage into a 'CONTENTS' stream. It creates CONTENTS, immediately releases it, but leaves the freed pointer in pstmContents. If UtReadOlePresStmHeader then fails, the function falls through to cleanup and releases pstmContents again, a double-free. The January 2025 fix nulls the pointer after the first release.
Impact
Zero-click RCE in the context of the user opening or previewing a malicious RTF document/email.
Public PoC
# poc/cve-2025-21298-poc.rtf (tested by opening in Word; other RTF parsers such
# as Outlook also reach it). Crashes with a double-free, not a full exploit.
{\rtf1{\object\objhtml\objw1\objh1\objupdate\rsltpict{\*\objclass None}{\*\objdata 0105000002000000
0a000000
53746174696344696200
00000000
00000000
04000000
00000000
00000000
05000000
02000000
aa00
02000000
00000000
}
}}Source: ynwarcs - CVE-2025-21298 (memory corruption PoC)
Detection
Verify January 2025 updates; filter inbound email for RTF attachments/bodies with embedded \objdata OLE objects; watch for Outlook/WINWORD crashes in ole32.dll.
Mitigation
Patch. Workaround: configure Outlook to read all mail in plain text (reduces usability).