CVE-2025-21363: Microsoft Word RCE Vulnerability

CVE-2025-21363 Overview

CVE-2025-21363 is a remote code execution vulnerability affecting Microsoft Word within Microsoft 365 Apps and Office Long Term Servicing Channel (LTSC) products. This vulnerability is classified under CWE-822 (Untrusted Pointer Dereference), indicating that the application improperly handles pointer references from untrusted sources, potentially allowing an attacker to execute arbitrary code on the target system.

The vulnerability requires local access and user interaction to exploit—typically through opening a maliciously crafted Word document. If successfully exploited, an attacker could gain the same privileges as the current user, enabling full compromise of confidentiality, integrity, and availability on the affected system.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code with user-level privileges through malicious Word documents, potentially leading to complete system compromise.

Affected Products

• Microsoft 365 Apps for Enterprise (x64 and x86)
• Microsoft Office Long Term Servicing Channel 2021 (macOS)
• Microsoft Office Long Term Servicing Channel 2024 (x64, x86, and macOS)

Discovery Timeline

• 2025-01-14 - CVE-2025-21363 published to NVD
• 2025-07-01 - Last updated in NVD database

Technical Details for CVE-2025-21363

Vulnerability Analysis

This remote code execution vulnerability stems from an untrusted pointer dereference (CWE-822) within Microsoft Word's document parsing functionality. When processing specially crafted document content, Word fails to properly validate pointer references before use, creating an exploitable condition.

The vulnerability requires local access to the target system and user interaction—specifically, the victim must open a maliciously crafted Word document. This attack pattern is common in spear-phishing campaigns where threat actors send weaponized documents via email or host them on compromised websites.

Upon successful exploitation, the attacker achieves code execution with the privileges of the current user. In environments where users operate with elevated permissions, this could result in complete system compromise including data theft, malware installation, or lateral movement within the network.

Root Cause

The root cause of CVE-2025-21363 is an untrusted pointer dereference vulnerability (CWE-822). Microsoft Word improperly trusts and dereferences pointers contained within or derived from document content without adequate validation. This allows an attacker to craft a document that causes Word to dereference a controlled pointer value, potentially redirecting execution flow to attacker-controlled code.

Attack Vector

The attack vector is local with required user interaction. A typical exploitation scenario involves:

1. An attacker crafts a malicious Word document containing embedded content designed to trigger the pointer dereference vulnerability
2. The document is delivered to the victim through phishing emails, malicious downloads, or compromised file shares
3. When the victim opens the document, Microsoft Word processes the malicious content
4. The untrusted pointer dereference occurs during document parsing, allowing the attacker's code to execute
5. The attacker gains code execution with the privileges of the user running Word

This vulnerability mechanism relies on social engineering to deliver the malicious document to potential victims. See the Microsoft Security Update for additional technical details.

Detection Methods for CVE-2025-21363

Indicators of Compromise

• Unexpected Microsoft Word crashes or application hangs when opening documents from untrusted sources
• Anomalous child processes spawned by WINWORD.EXE such as cmd.exe, powershell.exe, or script interpreters
• Suspicious network connections initiated by Word processes following document opening
• Unusual file system activity or registry modifications by Word processes

Detection Strategies

• Deploy endpoint detection rules to monitor for suspicious child process creation from Microsoft Office applications
• Implement behavioral analysis to detect anomalous execution patterns following document opens
• Configure email security gateways to sandbox and analyze Word document attachments before delivery
• Monitor for Office applications making unexpected outbound network connections

Monitoring Recommendations

• Enable Microsoft Office Application Guard to isolate document processing in a containerized environment
• Configure Windows Defender Application Control policies to restrict executable code from Office processes
• Implement centralized logging for Office application events and correlate with SIEM platforms
• Deploy SentinelOne agents with Storyline technology to automatically correlate suspicious Office-related activities

How to Mitigate CVE-2025-21363

Immediate Actions Required

• Apply the latest Microsoft security updates for Microsoft 365 Apps and Office LTSC products immediately
• Enable Protected View in Microsoft Word to open documents from untrusted sources in a restricted environment
• Train users to avoid opening Word documents from unknown or suspicious sources
• Consider implementing application allowlisting to prevent unauthorized code execution

Patch Information

Microsoft has released security updates addressing this vulnerability through the January 2025 security update cycle. Affected organizations should apply patches available through Windows Update, Microsoft Update Catalog, or their enterprise deployment tools such as WSUS or Configuration Manager. Refer to the Microsoft Security Update Guide for CVE-2025-21363 for specific patch information and deployment guidance.

Workarounds

• Enable Protected View for all documents originating from the internet or untrusted locations
• Configure Microsoft Office to open documents in Application Guard for enhanced isolation
• Block execution of macros and active content in Office documents via Group Policy
• Restrict Office applications from creating child processes using Attack Surface Reduction (ASR) rules

# Enable ASR rule to block Office applications from creating child processes
# Run in elevated PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled

# Enable ASR rule to block Office apps from creating executable content
Set-MpPreference -AttackSurfaceReductionRules_Ids 3b576869-a4ec-4529-8536-b80a7769e899 -AttackSurfaceReductionRules_Actions Enabled