CVE-2025-29791: Microsoft 365 Apps RCE Vulnerability

CVE-2025-29791 Overview

CVE-2025-29791 is a type confusion vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw is classified under [CWE-843] (Access of Resource Using Incompatible Type) and affects multiple Microsoft Office product lines including Microsoft 365 Apps, Office 2016, Office 2019, and Office Long Term Servicing Channel 2021 and 2024 on both Windows and macOS. Exploitation requires user interaction, typically through opening a crafted Office document. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected host.

Critical Impact
An attacker who convinces a user to open a malicious Office document can execute arbitrary code in the context of the current user, leading to full local compromise.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Office 2016 and Office 2019
Microsoft Office Long Term Servicing Channel 2021 and 2024 (Windows and macOS)

Discovery Timeline

2025-04-08 - CVE-2025-29791 published to the National Vulnerability Database
2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-29791

Vulnerability Analysis

The vulnerability is a type confusion flaw [CWE-843] in Microsoft Office. Type confusion occurs when code allocates or accesses a resource using one type but later interprets it as an incompatible type. This mismatch breaks the assumptions enforced by the memory layout and object metadata. Attackers can leverage the confusion to read or write memory outside the bounds of the original object. When the corrupted object contains function pointers, virtual table references, or size fields, an attacker can pivot the primitive into arbitrary code execution.

The vulnerability carries an EPSS score of 0.611%, placing it in the 70th percentile of vulnerabilities by predicted exploitation likelihood.

Root Cause

Microsoft Office parses complex compound document formats, embedded objects, and OLE structures. The root cause is improper validation of the underlying type of a structured object during parsing or processing. Office code accesses the object using a method or cast appropriate for a different type, corrupting adjacent memory or hijacking control flow.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious Office document and delivers it through email, a download link, or a shared drive. When the target opens the document in a vulnerable Office version, the parser triggers the type confusion and executes attacker-controlled code under the user's privileges. No authentication is required on the target system beyond the user's own session.

No public proof-of-concept code is available in the referenced sources. See the Microsoft Security Update CVE-2025-29791 advisory for vendor technical details.

Detection Methods for CVE-2025-29791

Indicators of Compromise

Office processes such as WINWORD.EXE, EXCEL.EXE, or POWERPNT.EXE spawning unexpected child processes including cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Office applications writing executable files, scripts, or DLLs into user-writable directories such as %TEMP%, %APPDATA%, or %PUBLIC%.
Unexpected outbound network connections initiated directly by Office processes shortly after document open events.
Crashes or abnormal terminations of Office processes correlated with the opening of documents from external sources.

Detection Strategies

Hunt for parent-child process relationships where Office applications spawn scripting or living-off-the-land binaries.
Inspect documents received from external senders for embedded objects, unusual OLE streams, or anomalous compound file structures.
Correlate Office crash telemetry from Windows Error Reporting with subsequent suspicious process or file activity on the same host.
Apply YARA rules targeting malformed Office document structures referenced in vendor and community threat reports.

Monitoring Recommendations

Forward Microsoft-Windows-Sysmon, Defender, and Office telemetry to a centralized analytics platform for cross-host correlation.
Monitor for new persistence entries such as Run keys, scheduled tasks, or startup folder items created within minutes of an Office process launch.
Track endpoints running Office builds that predate the April 2025 security updates and prioritize them for patch validation.

How to Mitigate CVE-2025-29791

Immediate Actions Required

Apply the April 2025 Microsoft security updates for all affected Office channels, including Microsoft 365 Apps, Office 2016, Office 2019, and Office LTSC 2021 and 2024.
Inventory endpoints to confirm Office build numbers and identify systems still running vulnerable versions.
Enforce Protected View and Office Application Guard for documents originating from the internet or other untrusted locations.
Block or quarantine inbound Office attachments from external senders at the email gateway pending patch deployment.

Patch Information

Microsoft has released security updates addressing CVE-2025-29791. Refer to the Microsoft Security Update CVE-2025-29791 advisory for the specific build numbers and KB articles applicable to each Office channel. Microsoft 365 Apps customers should ensure Click-to-Run automatic updates have applied the April 2025 release.

Workarounds

Disable or restrict execution of macros and ActiveX content in Office through Group Policy until patches are deployed.
Configure Attack Surface Reduction rules to block Office applications from creating child processes and from injecting code into other processes.
Use Microsoft Defender Application Control or AppLocker to restrict the binaries that Office processes can launch.

bash

# Example: enforce Attack Surface Reduction rules via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A, `
  3B576869-A4EC-4529-8536-B80A7769E899, `
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled