CVE-2025-24077 Overview
CVE-2025-24077 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word that allows an unauthorized attacker to execute arbitrary code locally. The flaw affects Microsoft 365 Apps and Microsoft Office Long Term Servicing Channel installations on both Windows and macOS. Exploitation requires user interaction, typically by opening a specially crafted Word document. Successful exploitation grants the attacker code execution in the context of the current user, leading to confidentiality, integrity, and availability impact on the affected host.
Critical Impact
An attacker who convinces a user to open a malicious Word document can execute arbitrary code with the user's privileges, enabling malware deployment, data theft, or lateral movement.
Affected Products
- Microsoft 365 Apps (Enterprise, x64 and x86)
- Microsoft Office Long Term Servicing Channel 2021 (macOS)
- Microsoft Office Long Term Servicing Channel 2024 (Windows x64, x86, and macOS)
Discovery Timeline
- 2025-03-11 - CVE-2025-24077 published to NVD
- 2025-07-02 - Last updated in NVD database
Technical Details for CVE-2025-24077
Vulnerability Analysis
The vulnerability is a use-after-free condition [CWE-416] in Microsoft Office Word's document parsing logic. Word frees a heap-allocated object during document processing but retains a dangling pointer that is later dereferenced. When the freed memory is reallocated and controlled by attacker-supplied data, the dereference can be steered into attacker-controlled code paths.
Exploitation requires the victim to open a crafted Word document delivered through phishing, removable media, or a malicious file share. No authentication is required on the target system, but user interaction is mandatory. Code executes with the privileges of the user opening the document, providing an initial foothold for follow-on activity such as credential theft or persistence.
Root Cause
The root cause is improper object lifetime management within Word's parser. A reference to an object remains live after the underlying allocation is released. Subsequent operations on that stale reference trigger memory corruption that can be shaped into a controlled write or function pointer overwrite.
Attack Vector
The attack vector is local and requires user interaction. An attacker crafts a malicious .docx or .doc file that triggers the vulnerable code path during open, preview, or parse operations. Delivery typically occurs through email attachments, OneDrive or SharePoint links, or drive-by download. The Preview Pane in Outlook or Windows Explorer can also serve as a trigger surface for Office file parsing bugs.
No verified public proof-of-concept is available at the time of writing. Technical details are documented in the Microsoft Security Update CVE-2025-24077 advisory.
Detection Methods for CVE-2025-24077
Indicators of Compromise
- Unexpected child processes spawned by winword.exe, particularly cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
- Word writing executable files, scripts, or DLLs to disk outside of normal document save paths.
- Crashes or abnormal terminations of winword.exe correlating with opening of received attachments.
- Outbound network connections initiated by winword.exe to untrusted hosts shortly after document open.
Detection Strategies
- Hunt for process lineage where winword.exe is the parent of script interpreters or LOLBins.
- Inspect Office telemetry and Windows Event Logs (Application log, source Microsoft Office) for crash events in Word.
- Apply YARA or sandbox detonation rules to inbound .doc, .docx, and .rtf attachments to identify malformed structures.
Monitoring Recommendations
- Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office child process creation and executable content from email.
- Forward Sysmon process creation, image load, and file create events to a centralized SIEM for retroactive hunting.
- Alert on first-seen file writes from winword.exe into startup, %AppData%, or %ProgramData% locations.
How to Mitigate CVE-2025-24077
Immediate Actions Required
- Apply the March 2025 Microsoft security updates for Microsoft 365 Apps and Office Long Term Servicing Channel 2021 and 2024 on all Windows and macOS endpoints.
- Enforce Protected View and Block macros from running in Office files from the internet via Group Policy.
- Educate users to avoid opening unexpected Word attachments and to report suspicious documents.
Patch Information
Microsoft released a security update addressing CVE-2025-24077. Refer to the Microsoft Security Update CVE-2025-24077 advisory for the specific build numbers and channels. Deploy updates through Microsoft Update, Click-to-Run, Microsoft Intune, or your standard patch management workflow. Verify update installation by checking the Office version under File > Account > About Word.
Workarounds
- Disable the Outlook and Windows Explorer Preview Pane to prevent automatic parsing of untrusted Office files.
- Enable Microsoft Defender Attack Surface Reduction rule Block all Office applications from creating child processes (GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A).
- Restrict execution of Office files from untrusted locations using AppLocker or Windows Defender Application Control policies.
# Configuration example: Enable ASR rule to block Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
# Verify ASR rule state
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
