CVE-2025-29822: Microsoft Office Auth Bypass Vulnerability

CVE-2025-29822 Overview

CVE-2025-29822 is a security feature bypass vulnerability in Microsoft Office OneNote. The flaw stems from an incomplete list of disallowed inputs [CWE-184], allowing an unauthorized attacker to bypass protections that normally block dangerous file types or content within OneNote notebooks. Exploitation requires local access and user interaction, typically by opening a crafted OneNote file. Microsoft assigned the issue a CVSS 3.1 score of 7.8 and rated it High severity. Affected products include Microsoft Office 2019, Office Long Term Servicing Channel (LTSC) 2021 and 2024, and Microsoft OneNote 2016, across Windows and macOS platforms.

Critical Impact
Successful exploitation bypasses OneNote's content filtering and can lead to arbitrary code execution in the context of the logged-on user, compromising confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Office 2019 (x64 and x86)
Microsoft Office LTSC 2021 and 2024 (Windows and macOS)
Microsoft OneNote 2016 and Microsoft OneNote for macOS

Discovery Timeline

2025-04-08 - CVE-2025-29822 published to the National Vulnerability Database (NVD)
2025-04-08 - Microsoft releases security update guidance for CVE-2025-29822
2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-29822

Vulnerability Analysis

The vulnerability is classified under [CWE-184] Incomplete List of Disallowed Inputs. OneNote maintains an internal block list of file types and embedded content that the application refuses to launch or render directly. The list is incomplete, leaving specific file extensions or embedded object types unhandled by the security check. An attacker crafts a OneNote notebook (.one or .onepkg) containing an embedded payload of a type the filter fails to recognize. When the user opens the notebook and interacts with the embedded item, OneNote executes or loads the content without invoking the protection that would normally apply. The result is a bypass of the security feature designed to prevent users from launching attacker-supplied content from inside Office documents.

Root Cause

The root cause is an allow-by-default behavior in OneNote's input validation logic. The deny list enumerates known-dangerous file types, but the enumeration is not exhaustive. Any content type omitted from the list inherits the application's default execution path. This is the same class of weakness that has historically affected Office's MOTW-aware and embedded-file dialogs.

Attack Vector

The attack vector is local with required user interaction. The attacker delivers a malicious OneNote notebook through email, file share, removable media, or a download link. The user opens the notebook in a vulnerable OneNote client and activates the embedded object. Because the bypass evades the warning prompt or block, the user is not alerted that the content is untrusted. Execution occurs at the privilege level of the current user. The vulnerability does not provide remote exploitation by itself and depends on social engineering to trigger.

No public proof-of-concept code is available. See the Microsoft Security Update Guide for CVE-2025-29822 for vendor technical details.

Detection Methods for CVE-2025-29822

Indicators of Compromise

OneNote files (.one, .onepkg) arriving from external senders that contain embedded objects, scripts, or executables.
Child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, or rundll32.exe spawned by ONENOTE.EXE or ONENOTEM.EXE.
Unexpected file writes by OneNote into %TEMP%, %APPDATA%, or %PROGRAMDATA%, followed by execution of the dropped file.
Outbound network connections originating from OneNote shortly after a notebook is opened.

Detection Strategies

Hunt for process-tree anomalies where ONENOTE.EXE is the parent of script interpreters or LOLBins.
Inspect inbound mail attachments and SharePoint uploads for OneNote files containing embedded file streams or unusual MIME parts.
Correlate Microsoft Defender or EDR telemetry for OneNote launching binaries from user-writable directories.

Monitoring Recommendations

Enable Office and OneNote audit logging and forward Sysmon Event IDs 1 (process create) and 11 (file create) to your SIEM.
Alert on any execution chain that begins with OneNote and pivots to network or persistence-related activity such as Run-key or Scheduled Task creation.
Track Microsoft 365 update compliance to confirm patched OneNote builds are deployed fleet-wide.

How to Mitigate CVE-2025-29822

Immediate Actions Required

Apply Microsoft's April 2025 security updates for Office 2019, Office LTSC 2021, Office LTSC 2024, and OneNote 2016 on Windows and macOS endpoints.
Inventory installations using OneNote 2016 and OneNote for macOS and prioritize patching for users who routinely receive external documents.
Block inbound .one and .onepkg attachments at the mail gateway, or quarantine them for analyst review.
Reinforce user awareness that OneNote attachments from unknown senders should not be opened.

Patch Information

Microsoft published a fix on April 8, 2025. Refer to the Microsoft Security Update Guide for CVE-2025-29822 for the exact build numbers per channel and platform. Click-to-Run installations update through the standard Office update channel, while MSI installations require the corresponding security update package.

Workarounds

Configure the OneNote BlockedExtensions Group Policy to extend the list of file types OneNote refuses to open from embedded content.
Use Microsoft Defender Attack Surface Reduction (ASR) rule "Block Office applications from creating child processes" to limit post-exploitation behavior.
Restrict OneNote from launching embedded files by enforcing Protected View and Trust Center settings via Group Policy or Intune.

bash

# Example: enforce OneNote blocked extensions via Group Policy registry key (Windows)
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\OneNote\Options" /v "DisableEmbeddedFiles" /t REG_DWORD /d 1 /f

# Example: enable ASR rule blocking Office child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled