CVE-2025-27747: Microsoft 365 Apps Use After Free Flaw

CVE-2025-27747 Overview

CVE-2025-27747 is a use-after-free vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute arbitrary code locally. The flaw resides in Word's document handling logic and is triggered when a user opens a crafted document. Successful exploitation grants the attacker code execution in the context of the current user. Microsoft published the advisory on April 8, 2025, and the entry was last updated in the National Vulnerability Database (NVD) on July 9, 2025. The vulnerability is tracked under CWE-822: Untrusted Pointer Dereference.

Critical Impact
An attacker who convinces a user to open a malicious Word document can execute arbitrary code with the privileges of the logged-on user, leading to full compromise of confidentiality, integrity, and availability on the host.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Office 2019, Office Long Term Servicing Channel (LTSC) 2021 and 2024 (Windows and macOS)
Microsoft Word 2016, SharePoint Server 2019, and SharePoint Enterprise Server 2016

Discovery Timeline

2025-04-08 - CVE-2025-27747 published to NVD and Microsoft security advisory released
2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-27747

Vulnerability Analysis

The vulnerability is a use-after-free condition in Microsoft Word's document parsing and rendering code. Word frees an internal object during document processing but retains a stale pointer that is later dereferenced. When the freed memory is reallocated and populated with attacker-controlled data, the dereference enables control over execution flow. The condition maps to [CWE-822: Untrusted Pointer Dereference], which extends the use-after-free pattern by emphasizing dereference of a pointer whose contents are no longer trustworthy.

Exploitation requires user interaction. The victim must open a crafted .doc, .docx, .rtf, or related Office document. Because Word runs in the user's session, code executes with the current user's privileges. The CVSS vector indicates the attack is local with low complexity, requires no privileges, and impacts confidentiality, integrity, and availability.

The Preview Pane is a recognized vector for similar Office memory corruption issues, allowing the malicious object to be processed without an explicit open action. Server-side processing in SharePoint Server 2016 and 2019 expands the attack surface to documents handled by collaboration services.

Root Cause

The root cause is improper lifetime management of an internal object in Word. After the object is freed, a reference to it remains and is later dereferenced during continued document processing. Crafted document structures cause the freed slot to be reclaimed by attacker-controlled data before the dereference occurs.

Attack Vector

The attack vector is local file delivery. Adversaries typically distribute weaponized Word documents through phishing email, watering-hole downloads, or shared SharePoint content. Once opened, the document triggers the vulnerable code path and executes the embedded shellcode or loader within the user's security context.

No public proof-of-concept or in-the-wild exploitation has been confirmed. The EPSS score of 0.602% places the vulnerability in the 69.9th percentile of likelihood of exploitation activity. Verified exploit code is not available in public repositories at the time of writing.

Detection Methods for CVE-2025-27747

Indicators of Compromise

Microsoft Word (winword.exe) spawning child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe
Office documents arriving from external senders with embedded objects, unusual OLE streams, or templates referencing remote URLs
winword.exe initiating outbound network connections to non-Microsoft domains shortly after document open
New persistence entries (Run keys, scheduled tasks, startup items) created within seconds of opening a Word document

Detection Strategies

Hunt for parent-child process anomalies where winword.exe launches scripting engines or LOLBins, a behavioral pattern consistent with Office exploitation
Monitor for crash telemetry and Windows Error Reporting (WER) events tied to winword.exe correlated with document opens, which can indicate failed exploitation attempts
Inspect SharePoint and Exchange logs for inbound documents matching known malicious hashes or carrying suspicious template references

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting code into other processes
Forward Office telemetry, Sysmon process and file events, and EDR alerts to a centralized SIEM for correlation across endpoints and SharePoint servers
Alert on any execution of unsigned binaries written to %TEMP%, %APPDATA%, or %LOCALAPPDATA% by winword.exe

How to Mitigate CVE-2025-27747

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update Guide for CVE-2025-27747 to all affected Office, Microsoft 365 Apps, Word, and SharePoint deployments
Prioritize patching workstations used by high-risk roles such as executives, finance, and IT administrators
Enable Protected View and Block macros from running in Office files from the internet via Group Policy
Disable the Outlook Preview Pane for untrusted mail flows until patches are deployed

Patch Information

Microsoft released fixed builds for Microsoft 365 Apps, Office 2019, Office LTSC 2021 and 2024 (Windows and macOS), Word 2016, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Refer to the Microsoft Security Update Guide for build numbers and channel-specific update packages. Apply updates via Windows Update, Microsoft Update, Click-to-Run, or your patch management platform.

Workarounds

Configure Office File Block policy to prevent opening legacy document formats from untrusted locations
Open untrusted documents only in Protected View or in an isolated sandbox such as Windows Sandbox or Application Guard for Office
Restrict document inflow through email gateway content disarm and reconstruction (CDR) until patches are confirmed installed

bash

# Group Policy registry settings to harden Word against malicious documents
# Force Protected View for documents originating from the internet
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f

# Block macros in files from the internet
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f