CVE-2025-24078: Microsoft 365 Apps Use After Free Flaw

CVE-2025-24078 Overview

CVE-2025-24078 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word that enables local code execution. An unauthenticated attacker can execute arbitrary code on a vulnerable system by convincing a user to open a crafted document. The flaw affects Microsoft Word 2016, Microsoft Office 2019, Microsoft Office Long Term Servicing Channel (LTSC) 2021 and 2024, and Microsoft 365 Apps across x86, x64, and macOS platforms. Exploitation requires user interaction but no prior privileges, making weaponized documents delivered via phishing a realistic attack scenario.

Critical Impact
Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the user running Microsoft Word, leading to full compromise of confidentiality, integrity, and availability on the target host.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019 (x86 and x64)
Microsoft Office LTSC 2021 and 2024 (Windows and macOS)
Microsoft Word 2016 (x86 and x64)

Discovery Timeline

2025-03-11 - CVE-2025-24078 published to the National Vulnerability Database (NVD)
2025-07-02 - Last updated in NVD database

Technical Details for CVE-2025-24078

Vulnerability Analysis

The vulnerability is a use-after-free condition in Microsoft Office Word's document parsing logic. The flaw occurs when Word references memory that has already been freed during the handling of a specially crafted document. An attacker controlling the freed allocation can manipulate program flow and achieve arbitrary code execution in the user's security context.

Exploitation is local and requires the victim to open a malicious file. The most likely delivery channel is a phishing email containing a weaponized .doc or .docx attachment, or a document hosted on an attacker-controlled file share or web page. Successful exploitation does not require elevated privileges, and the resulting code runs with the privileges of the Word process.

Root Cause

The root cause is improper memory lifetime management within Word's document object handling. A code path retains a pointer to an object after that object's memory is released. When the dangling pointer is later dereferenced, attacker-controlled data placed in the freed region can be used to hijack execution flow, typically through a corrupted virtual function table or callback pointer.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious Word document that triggers the vulnerable code path during parsing or rendering. When the victim opens the file, the use-after-free is triggered, allowing the attacker to execute code with the user's privileges. The high attack complexity reflects the precise heap grooming required to reliably control the freed allocation.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. For technical specifics, refer to the Microsoft CVE-2025-24078 Advisory.

Detection Methods for CVE-2025-24078

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, particularly cmd.exe, powershell.exe, rundll32.exe, or mshta.exe
Word process crashes followed by suspicious binaries written to %TEMP%, %APPDATA%, or %PUBLIC%
Outbound network connections initiated by WINWORD.EXE to untrusted hosts shortly after a document is opened
Creation or modification of Office trust-related registry keys without corresponding user action

Detection Strategies

Monitor process lineage for Office applications and alert on Word spawning scripting interpreters or LOLBins
Inspect inbound email attachments for Word documents containing embedded OLE objects, ActiveX controls, or unusual stream structures
Hunt for memory access violations in WINWORD.EXE correlated with the opening of attachments from external senders

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and writing executable content
Forward Sysmon process creation (Event ID 1) and image load (Event ID 7) logs from endpoints to a centralized analytics platform for correlation
Track Microsoft Office telemetry for repeated application crashes that may indicate failed exploitation attempts during heap grooming

How to Mitigate CVE-2025-24078

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2025-24078 Advisory across all affected Office installations
Inventory endpoints running Microsoft Word 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps to confirm patch coverage
Reinforce user awareness training focused on unsolicited Office attachments and documents downloaded from untrusted sources

Patch Information

Microsoft has released security updates for all affected products through the Microsoft Update Guide. Administrators should deploy the relevant patches via Windows Update, Microsoft Update for Business, WSUS, or Microsoft Intune. For macOS deployments of Office LTSC 2021 and 2024, apply updates through Microsoft AutoUpdate. Validate the installed Click-to-Run or MSI build numbers against the fixed versions listed in the advisory.

Workarounds

Open untrusted documents in Protected View and keep Office Protected View enabled for files from the Internet, Outlook attachments, and unsafe locations
Block or quarantine inbound .doc and .docx attachments from external senders at the email gateway until patches are deployed
Enforce the Attack Surface Reduction rule "Block all Office applications from creating child processes" via Group Policy or Intune

bash

# Enable the ASR rule that blocks Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify the rule is enforced
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids