CVE-2025-24079 Overview
CVE-2025-24079 is a use-after-free vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute code locally. The flaw is tracked under CWE-416 and affects multiple Microsoft Office product lines, including Microsoft 365 Apps, Office 2019, Word 2016, and the Office Long Term Servicing Channel 2021 and 2024 releases. Exploitation requires user interaction, typically opening a crafted document. Microsoft published the advisory on March 11, 2025 and last updated the entry on July 2, 2025.
Critical Impact
Successful exploitation enables arbitrary code execution in the context of the current user, leading to high impact on confidentiality, integrity, and availability of the affected host.
Affected Products
- Microsoft 365 Apps (Enterprise, x86 and x64)
- Microsoft Office 2019 and Word 2016 (x86 and x64)
- Microsoft Office Long Term Servicing Channel 2021 and 2024 (Windows and macOS)
Discovery Timeline
- 2025-03-11 - CVE-2025-24079 published to NVD
- 2025-03-11 - Microsoft released the security update for CVE-2025-24079
- 2025-07-02 - Last updated in NVD database
Technical Details for CVE-2025-24079
Vulnerability Analysis
The vulnerability is a use-after-free condition in Microsoft Office Word [CWE-416]. The application references heap memory after it has been freed, allowing an attacker to control the contents of the dangling pointer and redirect execution. Because Word parses complex document structures, an attacker can craft an Office document that triggers the freed object reference during parsing or rendering. The result is arbitrary code execution within the security context of the user running Word.
The attack vector is local and requires user interaction, meaning the target must open the malicious document. No privileges are required prior to exploitation, and the attack complexity is low. The EPSS probability is 0.209% with a percentile of 43.2, indicating limited observed exploitation activity at this time.
Root Cause
The root cause is improper lifetime management of an internal Word object. After the object is released, code continues to reference the freed memory region. Attackers groom the heap to place attacker-controlled data at the same address, converting the dangling reference into a controlled read or write primitive that leads to code execution.
Attack Vector
The typical delivery path is a weaponized Word document distributed via email attachment, web download, or file share. Once opened, the document triggers the vulnerable code path. Protected View provides a mitigating sandbox for documents originating from the internet, but users who disable Protected View or explicitly enable editing remove this barrier. Preview pane rendering may also process untrusted content depending on the configuration. Refer to the Microsoft Security Update CVE-2025-24079 advisory for component-level details.
Detection Methods for CVE-2025-24079
Indicators of Compromise
- Unexpected child processes spawned by WINWORD.EXE, such as cmd.exe, powershell.exe, mshta.exe, or rundll32.exe.
- Word process crashes or Windows Error Reporting (WER) entries referencing access violations during document parsing.
- Office documents arriving from external senders with embedded objects, unusual OLE streams, or obfuscated macros.
Detection Strategies
- Hunt for Word loading non-standard DLLs or writing executables to user-writable paths such as %TEMP% or %APPDATA%.
- Correlate document-open events with subsequent network connections from the Word process to untrusted destinations.
- Inspect documents for malformed structures, large embedded objects, or RTF/DOCX content that triggers heap manipulation patterns.
Monitoring Recommendations
- Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.
- Forward Office telemetry, Sysmon process and image-load events, and EDR alerts to a central SIEM for cross-host correlation.
- Track patch deployment status across all endpoints running Microsoft 365 Apps, Office 2019, Word 2016, and LTSC 2021 and 2024.
How to Mitigate CVE-2025-24079
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-24079 to all affected systems.
- Validate that Click-to-Run and Microsoft Update channels are reaching workstations, including remote and rarely-connected endpoints.
- Block inbound Office documents from untrusted senders at the email gateway and quarantine attachments for inspection.
Patch Information
Microsoft released the security update on March 11, 2025. Updates are delivered through Microsoft Update, the Microsoft Update Catalog, and Click-to-Run channels for Microsoft 365 Apps. Administrators should consult the Microsoft Security Update CVE-2025-24079 advisory for the specific build numbers that correspond to each affected SKU and channel.
Workarounds
- Enforce Protected View and Office File Block policies to prevent documents from external sources from rendering with full functionality.
- Disable the Outlook reading pane and File Explorer preview handlers for Office formats on high-risk endpoints.
- Restrict execution of documents containing OLE objects and active content through Group Policy until patching is complete.
# Example Group Policy registry settings to enforce Protected View for Word
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
