CVE-2025-29800 Overview
CVE-2025-29800 is an improper privilege management vulnerability in Microsoft AutoUpdate (MAU) for macOS. The flaw allows an authorized local attacker to elevate privileges on an affected system. MAU is the update client bundled with Microsoft 365 and Office applications on macOS, and it runs privileged helper components to install updates. An attacker with local, low-privileged access can abuse these privileged code paths to gain higher privileges. Microsoft categorizes the weakness under CWE-269: Improper Privilege Management.
Critical Impact
Local attackers with a valid user session can escalate to elevated privileges on macOS endpoints running vulnerable Microsoft AutoUpdate versions, compromising confidentiality, integrity, and availability.
Affected Products
- Microsoft AutoUpdate (MAU) on macOS
- Microsoft 365 and Office for Mac installations relying on the vulnerable MAU component
- Endpoints managed by MAU prior to the April 2025 security update
Discovery Timeline
- 2025-04-08 - CVE-2025-29800 published to NVD by Microsoft
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-29800
Vulnerability Analysis
Microsoft AutoUpdate installs and updates Microsoft applications on macOS through privileged helper processes. These helpers execute with elevated rights so they can write to protected locations such as /Applications and /Library/PrivilegedHelperTools. CVE-2025-29800 stems from improper privilege management within this workflow. The vulnerable component fails to properly restrict actions requested by a lower-privileged caller. An authenticated local user can direct the privileged helper to perform actions that should require administrator rights. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected host.
Root Cause
The root cause is a CWE-269 weakness in MAU's privileged operations. The component does not adequately validate the identity, entitlements, or requested operations of clients invoking its privileged interfaces. As a result, code paths intended for administrative use remain reachable from unprivileged contexts.
Attack Vector
Exploitation requires local access and a valid, low-privileged account on the target macOS system. No user interaction is required beyond the attacker's own session. After abusing the privileged helper, the attacker can execute code or modify files with elevated privileges. This provides a foothold for persistence, credential theft, or lateral movement.
No public proof-of-concept exploit is currently referenced in NVD, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update Guide for CVE-2025-29800 for vendor-supplied technical details.
Detection Methods for CVE-2025-29800
Indicators of Compromise
- Unexpected child processes spawned by Microsoft AutoUpdate.app or its helper binaries under /Library/PrivilegedHelperTools/
- Modifications to files under /Applications/Microsoft*.app or MAU update caches that do not correlate with a scheduled update window
- New or altered LaunchDaemons or LaunchAgents referencing MAU components
- User accounts gaining root-owned files or unexpected sudo/admin group membership shortly after MAU activity
Detection Strategies
- Monitor macOS Endpoint Security events (ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_WRITE) for privileged helper activity that originates from non-administrative user sessions.
- Correlate MAU process execution with subsequent privileged file writes outside standard update paths.
- Track version telemetry for Microsoft AutoUpdate across the fleet to identify hosts running pre-patch builds.
Monitoring Recommendations
- Enable unified logging and forward com.microsoft.autoupdate subsystem events to a central log platform for review.
- Alert on invocations of the MAU privileged helper by non-standard clients or from unusual working directories.
- Baseline normal MAU update cadence and flag out-of-band privileged operations.
How to Mitigate CVE-2025-29800
Immediate Actions Required
- Apply the Microsoft AutoUpdate security update referenced in the Microsoft Security Update Guide for CVE-2025-29800 to all macOS endpoints.
- Inventory macOS hosts running Microsoft 365 or Office for Mac and confirm MAU is updated to the fixed version.
- Restrict local, interactive access on shared macOS systems to reduce the pool of users who can trigger local privilege escalation.
Patch Information
Microsoft released a fixed version of Microsoft AutoUpdate alongside the April 2025 security updates. Administrators should ensure MAU is updated to the patched release identified in the Microsoft Security Update Guide for CVE-2025-29800. MDM tooling such as Jamf, Intune, or Kandji can enforce the update across managed macOS fleets.
Workarounds
- No official workaround replaces the patch. Where patching is delayed, limit administrative sign-ins and monitor MAU privileged helper activity closely.
- Remove Microsoft AutoUpdate on systems where Microsoft 365 or Office for Mac is not required.
- Enforce least privilege on macOS user accounts to minimize the impact of local escalation on multi-user hosts.
# Verify installed Microsoft AutoUpdate version on macOS
defaults read "/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/Info.plist" CFBundleShortVersionString
# Trigger an update check via the MAU command-line helper
"/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/msupdate" --install
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
