CVE-2021-25832

CVE-2021-25832 is a critical heap buffer overflow vulnerability affecting ONLYOFFICE DocumentServer versions 4.0.0-9 through 6.0.0, specifically within its BMP image processing component. This flaw allows an unauthenticated attacker to achieve remote code execution (RCE) with high impact on confidentiality, integrity, and availability, as indicated by its CVSS score of 9.8. While there is no evidence of active exploitation (KEV list) or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, suggesting awareness and potential for future exploitation.