CVE-2025-29792: Microsoft 365 Apps Privilege Escalation

CVE-2025-29792 Overview

CVE-2025-29792 is a use-after-free vulnerability [CWE-416] in Microsoft Office that allows an authorized local attacker to elevate privileges. The flaw affects Microsoft 365 Apps, Microsoft Office 2016 and 2019, and Microsoft Office Long Term Servicing Channel 2021 and 2024. Exploitation requires local access, low privileges, and user interaction, meaning an attacker must convince a signed-in user to open a crafted Office document or perform a specific action. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected host.

Critical Impact
An authorized local attacker can trigger memory corruption in Microsoft Office to elevate privileges and gain full control over the affected user context.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Office 2016 and Microsoft Office 2019
Microsoft Office Long Term Servicing Channel 2021 and 2024

Discovery Timeline

2025-04-08 - CVE-2025-29792 published to NVD as part of Microsoft's April 2025 security update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29792

Vulnerability Analysis

The vulnerability is a use-after-free condition in Microsoft Office. Use-after-free flaws occur when an application continues to reference memory after it has been released. An attacker who controls the contents of the freed and subsequently reallocated memory region can steer execution flow or corrupt program state.

In this case, exploitation requires an authorized local user to interact with attacker-supplied content. The Microsoft advisory characterizes the outcome as local privilege elevation, meaning the attacker gains rights beyond those held by the invoking user context. The confidentiality, integrity, and availability impact are all rated high in the CVSS vector, reflecting full compromise of the affected process and its data.

Root Cause

The root cause is improper management of object lifetime within an Office component. A memory object is freed while a pointer or reference to it remains reachable. When the dangling reference is later dereferenced, Office operates on memory that may have been reclaimed and populated with attacker-controlled data.

Attack Vector

The attack vector is local and requires user interaction. An attacker with low privileges on the target system delivers a crafted document or triggers a specific Office workflow. Once the vulnerable code path is reached, the freed object is reused, enabling the attacker to elevate privileges within the Office process boundary. No verified public proof-of-concept is available at this time. See the Microsoft CVE-2025-29792 Advisory for vendor technical details.

Detection Methods for CVE-2025-29792

Indicators of Compromise

Unexpected child processes spawned from winword.exe, excel.exe, powerpnt.exe, or outlook.exe running with elevated privileges.
Office applications loading unsigned or unusual DLLs from user-writable directories such as %APPDATA% or %TEMP%.
Office process crashes with access violation exceptions preceding suspicious process activity, indicating potential exploitation attempts.

Detection Strategies

Monitor for anomalous Office process behavior including memory region allocations marked as executable and token manipulation events.
Correlate Office document open events with subsequent script interpreter or LOLBin execution such as powershell.exe, cmd.exe, or rundll32.exe.
Enable Microsoft Office telemetry and Windows Event ID 4688 process creation logging with command-line auditing.

Monitoring Recommendations

Ingest endpoint process, file, and module-load telemetry into a centralized analytics platform to identify chained exploitation patterns.
Track patch compliance for Microsoft 365 Apps and Office LTSC across the fleet and alert on hosts running unpatched builds.
Review authentication and privilege-use logs on endpoints where Office runs, looking for token elevation events tied to Office child processes.

How to Mitigate CVE-2025-29792

Immediate Actions Required

Apply the Microsoft security update for CVE-2025-29792 to all affected Microsoft 365 Apps, Office 2016, Office 2019, and Office LTSC 2021 and 2024 installations.
Prioritize patching on multi-user systems, jump hosts, and workstations where privilege elevation would expand attacker reach.
Restrict local user privileges and enforce least-privilege policies to reduce the value of a successful local elevation.

Patch Information

Microsoft released updates addressing CVE-2025-29792 as part of its April 2025 security update cycle. Refer to the Microsoft CVE-2025-29792 Advisory for the specific update packages that correspond to each affected product and channel. Verify installation using Windows Update history or the Office File > Account > Update Options menu.

Workarounds

Enable Protected View and Application Guard for Office to isolate documents originating from untrusted sources such as email and the internet.
Block or restrict macros and active content in Office documents through Group Policy, particularly for files marked with the Mark-of-the-Web attribute.
Use attack surface reduction (ASR) rules to prevent Office applications from creating child processes and injecting into other processes.

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Enable ASR rule: Block Office applications from injecting code into other processes
Set-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 -AttackSurfaceReductionRules_Actions Enabled