CVE-2025-26629: Microsoft 365 Apps Use After Free Flaw

CVE-2025-26629 Overview

CVE-2025-26629 is a use-after-free vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw affects Microsoft 365 Apps and Microsoft Office Long Term Servicing Channel 2024 on both x86 and x64 platforms. Successful exploitation requires user interaction, typically opening a crafted Office document. The vulnerability is tracked under [CWE-416] (Use After Free) and can lead to full compromise of confidentiality, integrity, and availability on the affected host. Microsoft addressed the issue through its Security Update Guide on March 11, 2025.

Critical Impact
An attacker who tricks a user into opening a malicious Office file can execute arbitrary code in the context of the current user, enabling malware installation, data theft, or lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office Long Term Servicing Channel 2024 (x86 and x64)
Office deployments sharing the vulnerable component code

Discovery Timeline

2025-03-11 - CVE-2025-26629 published to NVD and addressed in the Microsoft Security Update Guide
2025-07-01 - Last updated in NVD database

Technical Details for CVE-2025-26629

Vulnerability Analysis

The vulnerability is a use-after-free condition within Microsoft Office. A use-after-free occurs when an application continues to reference memory after it has been freed. Attackers exploit this state by reallocating the freed memory region with attacker-controlled data, then triggering the dangling pointer dereference to redirect execution.

The attack requires local access with user interaction. A victim must open a specially crafted document delivered through email, a network share, or a web download. Once the file is opened, the malformed object handling logic frees an internal structure but retains a reference that is later invoked.

Code executes in the context of the logged-in user. If the user holds administrative privileges, the attacker gains full control of the system. Standard user contexts still permit data exfiltration, persistence, and chained privilege escalation.

Root Cause

The root cause is improper object lifetime management in an Office parsing or rendering component. The application releases an object while a pointer to it remains in use, creating a dangling reference [CWE-416]. Crafted document content controls the timing of the free and the subsequent reuse.

Attack Vector

Delivery typically occurs through phishing campaigns distributing weaponized .docx, .xlsx, .rtf, or related Office files. The attacker controls heap layout through embedded objects, OLE streams, or scripted content. After the freed allocation is reclaimed with attacker data, the application dereferences the stale pointer, transferring control to attacker-supplied bytes or function pointers.

No verified public proof-of-concept code is available. Refer to the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2025-26629

Indicators of Compromise

Office processes such as winword.exe, excel.exe, or powerpnt.exe spawning command interpreters like cmd.exe, powershell.exe, or wscript.exe
Unexpected outbound network connections initiated by Office applications shortly after a document is opened
Office processes writing executable files or scripts to %TEMP%, %APPDATA%, or startup directories
Crash events in Windows Event Log referencing Office binaries followed by suspicious child process creation

Detection Strategies

Hunt for anomalous Office parent-child process trees, focusing on script interpreters and LOLBins spawned from Office binaries
Inspect inbound email attachments and downloads for Office documents containing embedded OLE objects, ActiveX controls, or unusual structured storage streams
Correlate Office application crashes with subsequent process creation or file write activity to identify exploitation attempts

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes
Forward Office telemetry, Sysmon process events, and EDR alerts to a centralized SIEM for cross-source correlation
Track patch deployment status across all Office endpoints to identify hosts that remain exposed

How to Mitigate CVE-2025-26629

Immediate Actions Required

Apply the March 2025 security updates from the Microsoft Security Update Guide to all affected Microsoft 365 Apps and Office LTSC 2024 installations
Verify Click-to-Run channels and managed deployments are updated, since cached installers may delay patch delivery
Restrict local administrator rights to limit the impact of successful exploitation
Block or quarantine Office documents originating from untrusted external sources at the email gateway

Patch Information

Microsoft released fixed builds for Microsoft 365 Apps and Microsoft Office Long Term Servicing Channel 2024. Administrators should consult the Microsoft Security Update Guide for the specific build numbers corresponding to their update channel and architecture.

Workarounds

Enable Protected View and Office Application Guard to open documents from the internet in an isolated container
Configure Group Policy to block macros and ActiveX controls in files from the internet, reducing the attack surface for weaponized documents
Use Microsoft Defender for Office 365 Safe Attachments to detonate inbound Office files in a sandbox before delivery

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f