Security Research

CVE-2025-21298 Windows OLE RCE: Plus-Offset Triggering Use-After-Free in CStdStubBuffer

#Vulnerability Analysis#Code Audit#Malware
CVE-2025-21298 Windows OLE RCE: Plus-Offset Triggering Use-After-Free in CStdStubBuffer

Windows OLE delegates object reference counting to ole32!CStdStubBuffer_Disconnect — the attacker crafts OLE references in an RTF document so the reference count jumps via plus-offset to a specific value, triggering premature object release; when the COPE framework later calls a virtual function on the freed object, the result is UAF.

Unlock to view this content.