CVE-2025-49699: Microsoft 365 Apps Use-After-Free Flaw

CVE-2025-49699 Overview

CVE-2025-49699 is a use-after-free vulnerability [CWE-416] in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw affects multiple Office components, including Word, PowerPoint, Outlook, Microsoft 365 Apps, and Office Long-Term Servicing Channel (LTSC) 2021 and 2024. Exploitation requires user interaction, typically opening a maliciously crafted Office document. Successful exploitation grants the attacker the privileges of the current user and can lead to full compromise of the host. Microsoft published the advisory on July 8, 2025.

Critical Impact
An attacker who convinces a user to open a crafted Office document can execute arbitrary code with the user's privileges, compromising confidentiality, integrity, and availability of the host.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (including macOS)
Microsoft Word 2016, PowerPoint 2016, and Outlook 2016

Discovery Timeline

2025-07-08 - CVE-2025-49699 published to NVD
2025-07-08 - Microsoft releases security update for CVE-2025-49699
2025-07-15 - Last updated in NVD database

Technical Details for CVE-2025-49699

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in Microsoft Office's document parsing or rendering logic. A use-after-free occurs when the application continues to reference a memory object after that object has been freed. An attacker who controls the freed memory region can craft data structures, such as fake virtual function tables, that redirect execution when the dangling pointer is dereferenced.

In the context of Office, the trigger is typically embedded within a malicious document (.docx, .pptx, .rtf, or an email attachment processed by Outlook). When Office parses the crafted content, it frees an internal object but retains references to it. Subsequent operations on the dangling reference cause the application to dereference attacker-controlled data, leading to arbitrary code execution within the Office process.

The EPSS score for this CVE is 0.361%, reflecting the local attack vector and user interaction requirement.

Root Cause

The root cause is improper object lifetime management in an Office component shared across Word, PowerPoint, and Outlook. The code path releases a heap-allocated object without invalidating outstanding pointers, allowing reuse of the dangling reference during continued document processing.

Attack Vector

Exploitation is local and requires user interaction. The typical delivery method is a phishing email containing a weaponized Office document or an Outlook preview that triggers the vulnerable parsing path. Once the user opens the file, the use-after-free fires and the attacker's shellcode runs under the user's account. Office process mitigations such as Address Space Layout Randomization (ASLR) and Control Flow Guard (CFG) raise the bar but can be bypassed with reliable heap-spray and information-leak techniques typical of UAF exploitation.

No public proof-of-concept or in-the-wild exploitation has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-49699

Indicators of Compromise

Office applications (WINWORD.EXE, POWERPNT.EXE, OUTLOOK.EXE) spawning unusual child processes such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Unexpected network connections originating from Office processes shortly after document open events.
Office process crashes followed by suspicious DLL loads or memory allocations consistent with shellcode execution.
Inbound email attachments or web downloads of Office documents from untrusted senders, particularly with macro or embedded object content.

Detection Strategies

Monitor for process-lineage anomalies where an Office binary is the parent of script interpreters or living-off-the-land binaries (LOLBins).
Apply behavioral AI identification on endpoints to flag exploitation patterns such as in-process shellcode and ROP-style control flow within Office processes. The Singularity Endpoint behavioral AI engine is designed to identify these zero-day exploitation behaviors without prior signatures.
Hunt across telemetry for sequences of document open followed by memory injection or remote thread creation in Office processes.

Monitoring Recommendations

Centralize Office, Outlook, and EDR telemetry in a SIEM or data lake to correlate file delivery, document open, and post-exploitation activity. The Singularity Data Lake supports OCSF-normalized ingestion for this correlation.
Track Office patch level across the fleet and alert on hosts still running pre-July 2025 builds of Word, PowerPoint, Outlook, and Microsoft 365 Apps.
Enable Microsoft Defender or equivalent attack surface reduction (ASR) telemetry, especially rules blocking child process creation from Office applications.

How to Mitigate CVE-2025-49699

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2025-49699 advisory to all affected Office installations.
Prioritize patching endpoints used by high-risk users such as executives, finance, and IT administrators who frequently receive external documents.
Verify that Microsoft 365 Apps update channels are not paused and that Office LTSC 2021/2024 installations have received the July 2025 cumulative update.

Patch Information

Microsoft released fixed builds for Microsoft 365 Apps, Office 2019, Office LTSC 2021, Office LTSC 2024 (Windows and macOS), Word 2016, PowerPoint 2016, and Outlook 2016 as part of the July 8, 2025 update cycle. Refer to the Microsoft Security Update CVE-2025-49699 advisory for the specific build numbers per channel.

Workarounds

Enable Protected View and Office Application Guard so that documents from the internet or email open in an isolated container.
Configure Microsoft Defender ASR rules to block child process creation and Win32 API calls from Office macros.
Block or quarantine inbound Office attachments from untrusted senders at the mail gateway, and disable preview of attachments in Outlook where feasible.
Restrict execution of legacy file formats (.doc, .ppt, .rtf) via Office Trust Center file block settings until patching is complete.

bash

# Verify Microsoft 365 Apps build on a Windows endpoint
reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v VersionToReport

# Force an Office update via the Click-to-Run client
"C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user