CVE-2025-29978: Microsoft 365 Apps Use-After-Free Flaw

CVE-2025-29978 Overview

CVE-2025-29978 is a use-after-free vulnerability [CWE-416] in Microsoft Office PowerPoint that allows local code execution. An unauthorized attacker can execute arbitrary code by tricking a user into opening a specially crafted PowerPoint file. The flaw affects Microsoft 365 Apps and Microsoft Office Long Term Servicing Channel 2024 on both x64 and x86 architectures. Microsoft addressed the issue through its May 2025 security update cycle. The vulnerability requires user interaction but no privileges, making it a viable target for phishing and document-based attack chains.

Critical Impact
Successful exploitation grants attackers code execution in the context of the current user, enabling malware deployment, credential theft, and lateral movement from a single opened PowerPoint document.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office Long Term Servicing Channel 2024 (x64)
Microsoft Office Long Term Servicing Channel 2024 (x86)

Discovery Timeline

2025-05-13 - CVE-2025-29978 published to NVD
2025-05-13 - Microsoft releases security update for CVE-2025-29978
2025-05-19 - Last updated in NVD database

Technical Details for CVE-2025-29978

Vulnerability Analysis

The vulnerability is a use-after-free condition in Microsoft Office PowerPoint. Use-after-free flaws occur when an application continues to reference memory after it has been freed. An attacker can manipulate the freed memory region to place attacker-controlled data, then trigger the dangling pointer to redirect execution flow.

In PowerPoint, parsing of malformed presentation objects can release a structure while another code path still holds a reference to it. When that reference is dereferenced, the attacker controls the contents of the reused allocation. This leads to arbitrary code execution within the PowerPoint process, running with the privileges of the logged-on user. The EPSS score of 0.742% reflects measurable risk of exploit activity emerging against this class of Office vulnerability.

Root Cause

The root cause is improper object lifetime management in PowerPoint's document parsing logic. The application frees an internal object while retaining pointers to it elsewhere in memory. Specially crafted file structures trigger the inconsistent state, allowing an attacker to groom the heap and substitute controlled data into the freed allocation.

Attack Vector

Exploitation requires a local attack vector with user interaction. An attacker delivers a malicious .pptx or related PowerPoint file through phishing emails, file shares, collaboration platforms, or compromised websites. When the victim opens the document, PowerPoint parses the embedded structures and triggers the use-after-free condition. No authentication is required, and the attack complexity is low.

The vulnerability does not provide remote network exploitation, but document-borne delivery effectively bridges that gap. Office Protected View provides some friction, but users routinely enable editing on documents that appear legitimate.

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. See the Microsoft Security Update CVE-2025-29978 advisory for vendor technical details.

Detection Methods for CVE-2025-29978

Indicators of Compromise

PowerPoint (POWERPNT.EXE) spawning child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Unexpected outbound network connections originating from the PowerPoint process shortly after a document is opened.
Crash dumps or Windows Error Reporting events referencing POWERPNT.EXE access violations during file parsing.
New executables, scripts, or scheduled tasks created in user-writable directories following PowerPoint document activity.

Detection Strategies

Hunt for Office applications spawning script interpreters or LOLBins, a high-fidelity signal of document-based code execution.
Inspect inbound email attachments and file-share uploads for PowerPoint files containing anomalous embedded objects or malformed structures.
Correlate user document-open events with process-tree anomalies to identify exploitation attempts targeting unpatched endpoints.

Monitoring Recommendations

Enable command-line and process-creation auditing on endpoints running Microsoft 365 Apps and Office LTSC 2024.
Forward Microsoft Defender Application Guard, Windows Defender Exploit Guard, and Office telemetry to a centralized SIEM for correlation.
Track patch deployment status for the May 2025 Microsoft security updates across all Office-installed assets.

How to Mitigate CVE-2025-29978

Immediate Actions Required

Apply the May 2025 Microsoft security update referenced in the Microsoft Security Update CVE-2025-29978 advisory to all affected systems.
Inventory all Microsoft 365 Apps and Office LTSC 2024 installations and confirm they receive updates through Click-to-Run or your managed update channel.
Block delivery of PowerPoint attachments from untrusted external senders at the email gateway until patching is verified.

Patch Information

Microsoft released a security update on May 13, 2025 that corrects the object lifetime handling in PowerPoint's document parser. Customers should update Microsoft 365 Apps and Office LTSC 2024 through their standard update channel. Refer to the Microsoft Security Update CVE-2025-29978 advisory for build numbers and channel-specific guidance.

Workarounds

Enforce Office Protected View and Application Guard for documents originating from the internet or untrusted locations.
Disable opening of legacy and non-essential PowerPoint file formats via Trust Center File Block Settings until patching completes.
Restrict end-user ability to enable editing on documents received from external sources through Group Policy.

bash

# Configuration example - Group Policy registry keys to harden PowerPoint File Block Settings
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\FileBlock" /v PowerPoint97Files /t REG_DWORD /d 2 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\FileBlock" /v OpenInProtectedView /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f