CVE-2025-21365: Microsoft 365 Apps RCE Vulnerability

CVE-2025-21365 Overview

CVE-2025-21365 is a remote code execution vulnerability affecting Microsoft Office products, including Microsoft 365 Apps and Office Long Term Servicing Channel 2024. This vulnerability is classified under CWE-426 (Untrusted Search Path), indicating that the flaw stems from improper handling of search paths during DLL loading operations. An attacker who successfully exploits this vulnerability could execute arbitrary code on the target system with the privileges of the current user.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code with user privileges, potentially leading to complete system compromise, data theft, or lateral movement within enterprise networks.

Affected Products

• Microsoft 365 Apps for Enterprise (x64 and x86 editions)
• Microsoft Office Long Term Servicing Channel 2024 (x64 and x86 editions)

Discovery Timeline

• January 14, 2025 - CVE-2025-21365 published to NVD
• July 1, 2025 - Last updated in NVD database

Technical Details for CVE-2025-21365

Vulnerability Analysis

This vulnerability exists due to an untrusted search path weakness (CWE-426) in Microsoft Office components. When Office applications load dynamic-link libraries (DLLs), they may search for these libraries in directories that can be controlled by an attacker. If a malicious DLL is placed in a location that the application searches before the legitimate system directories, the application will load and execute the malicious code instead.

The attack requires local access and user interaction, meaning the victim must open a malicious file or be lured to a directory containing the attacker-controlled DLL. Once triggered, the vulnerability allows code execution in the context of the current user, which could include administrative privileges if the user has elevated access.

Root Cause

The root cause is identified as CWE-426 (Untrusted Search Path). Microsoft Office applications fail to properly validate or restrict the directories from which DLLs are loaded during execution. This allows an attacker to place a malicious DLL in a location that takes precedence in the search order, such as the current working directory or a user-writable path, leading to DLL hijacking.

Attack Vector

The vulnerability requires local access to the target system and user interaction to trigger. An attacker must convince a user to open a specially crafted file from a location where a malicious DLL has been planted. This could be achieved through:

• Placing a malicious DLL in a network share alongside a legitimate Office document
• Tricking users into extracting archives containing both malicious DLLs and Office documents to the same directory
• Exploiting scenarios where users routinely open files from untrusted locations

The exploitation mechanism involves DLL search order hijacking, where the malicious library is loaded before the legitimate system library. For detailed technical information, refer to the Microsoft Security Advisory.

Detection Methods for CVE-2025-21365

Indicators of Compromise

• Unexpected DLL files appearing in user-accessible directories alongside Office documents
• Office applications loading DLLs from non-standard or user-writable paths
• Anomalous process behavior from Office applications, including unexpected child processes or network connections
• File system artifacts indicating DLL hijacking attempts in Office document directories

Detection Strategies

• Monitor for Office applications loading DLLs from the current working directory rather than system directories
• Implement application whitelisting to detect unauthorized DLL loading by Office processes
• Enable process creation auditing to identify suspicious child processes spawned by Office applications
• Deploy endpoint detection and response (EDR) solutions to detect DLL hijacking patterns

Monitoring Recommendations

• Configure SIEM rules to alert on Office process anomalies and unexpected DLL loads
• Monitor network shares and download directories for suspicious DLL files alongside Office documents
• Implement file integrity monitoring on critical directories used by Office applications
• Review Windows event logs for Module Load events (Sysmon Event ID 7) from Office processes loading DLLs from unusual paths

How to Mitigate CVE-2025-21365

Immediate Actions Required

• Apply the latest Microsoft security updates for affected Office products immediately
• Review and restrict permissions on network shares to prevent attackers from placing malicious DLLs
• Educate users about the risks of opening Office documents from untrusted locations or archives
• Consider implementing application control policies to restrict DLL loading from user-writable directories

Patch Information

Microsoft has released security updates addressing this vulnerability. Organizations should apply patches through Windows Update, Microsoft Update Catalog, or enterprise deployment tools such as WSUS or Configuration Manager. Detailed patch information and download links are available in the Microsoft Security Advisory.

Workarounds

• Configure Windows to require DLLs to be loaded only from system directories using the CWDIllegalInDllSearch registry setting
• Implement the SafeDllSearchMode registry setting to modify the DLL search order
• Deploy application control solutions like Windows Defender Application Control (WDAC) to prevent unauthorized DLL execution
• Restrict user access to network shares and removable media where malicious DLLs could be planted

# Enable SafeDllSearchMode to improve DLL search order security
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f

# Configure CWDIllegalInDllSearch to block DLL loading from current working directory
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch /t REG_DWORD /d 2 /f