CVE-2025-30377: Microsoft 365 Apps Use After Free Flaw

CVE-2025-30377 Overview

CVE-2025-30377 is a use-after-free vulnerability in Microsoft Office that allows an authenticated local attacker to execute arbitrary code. The flaw, tracked under CWE-416, affects Microsoft 365 Apps, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office Long Term Servicing Channel (LTSC) 2021 and 2024, and Microsoft Office Online Server. Microsoft released an advisory and patch addressing the issue in the May 2025 security update cycle.

Critical Impact
Successful exploitation grants the attacker full code execution in the context of the current user, leading to confidentiality, integrity, and availability compromise on the targeted host.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Excel 2016, Microsoft Office 2019
Microsoft Office LTSC 2021 and 2024 (Windows and macOS), Microsoft Office Online Server

Discovery Timeline

2025-05-13 - CVE-2025-30377 published to the National Vulnerability Database (NVD)
2025-05-13 - Microsoft publishes the CVE-2025-30377 security advisory and patch
2025-05-19 - Last updated in NVD database

Technical Details for CVE-2025-30377

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in Microsoft Office. The flaw occurs when Office code references a memory object after that object has already been freed. Reusing the dangling pointer allows an attacker to manipulate program control flow when the freed memory is reallocated with attacker-controlled data.

Exploitation requires the victim to open a specially crafted Office document on a local system. Because the attack vector is local and requires low privileges with no user interaction beyond document handling, the vulnerability is well-suited for targeted phishing campaigns that deliver malicious Office files. Successful exploitation produces arbitrary code execution in the security context of the user running Office.

Root Cause

The underlying defect is improper object lifetime management. Office releases an internal object but retains a pointer to its prior memory location. Subsequent operations dereference that stale pointer, allowing attacker-controlled data placed into the reclaimed allocation to influence virtual function dispatch or other indirect control transfers.

Attack Vector

An attacker crafts a malicious Office file (for example, an Excel workbook) containing structures that trigger the freed-object reuse path. The attacker delivers the file via email, file share, or web download. When the targeted user opens the document in a vulnerable Office build, the use-after-free is triggered and the embedded payload executes locally. No network access to the target is required.

No verified proof-of-concept code is available. See the Microsoft Security Response Center advisory for vendor-confirmed technical details.

Detection Methods for CVE-2025-30377

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, WINWORD.EXE, or other Office binaries (for example, cmd.exe, powershell.exe, rundll32.exe, or mshta.exe).
Office processes performing outbound network connections to untrusted hosts shortly after opening a document.
Crashes or anomalous memory access faults logged in Windows Error Reporting for Office processes.
Newly written executables, scripts, or scheduled tasks created by an Office process in user-writable directories such as %APPDATA% or %TEMP%.

Detection Strategies

Hunt for process-lineage anomalies where Office applications launch interpreters or LOLBins, a common post-exploitation behavior for document-based code execution.
Inspect inbound email attachments and shared documents for Excel and Office files containing suspicious embedded objects, macros, or malformed records.
Correlate Office crash telemetry (Application Error event ID 1000) with subsequent suspicious child-process activity on the same host.

Monitoring Recommendations

Enable command-line and module-load auditing on endpoints running Office and forward the events to a centralized analytics platform.
Track Office build numbers across the fleet to confirm the May 2025 update is installed and to surface lagging systems.
Monitor file-write activity by Office processes into auto-start locations and user profile directories.

How to Mitigate CVE-2025-30377

Immediate Actions Required

Apply the May 2025 Microsoft Office security updates referenced in the MSRC advisory for CVE-2025-30377 to all affected products.
Prioritize patching for users who routinely process externally sourced Office documents, such as finance, HR, and executive assistants.
Verify that Microsoft 365 Apps clients are on a serviced update channel and not pinned to an outdated build.

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024 (Windows and macOS), and Office Online Server. Refer to the Microsoft CVE-2025-30377 advisory for product-specific KB articles and build numbers.

Workarounds

Enable Protected View and Office Application Guard so that documents originating from the internet or email open in an isolated sandbox.
Block or restrict delivery of Office file types from external senders at the email gateway when business processes allow.
Apply Microsoft Attack Surface Reduction (ASR) rules that prevent Office applications from creating child processes and from injecting code into other processes.

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Enable ASR rule: Block Office applications from injecting code into other processes
Add-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
                 -AttackSurfaceReductionRules_Actions Enabled