CVE-2025-49700: Microsoft 365 Apps Use-After-Free Flaw

CVE-2025-49700 Overview

CVE-2025-49700 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word that allows an unauthorized attacker to execute arbitrary code locally. The flaw affects multiple Microsoft Office product lines, including Microsoft 365 Apps, Office 2019, Office Long Term Servicing Channel 2021 and 2024, and Word 2016. Exploitation requires user interaction, typically by convincing a target to open a crafted Word document. Successful exploitation grants the attacker code execution with the privileges of the logged-on user, enabling further compromise of the host.

Critical Impact
An attacker who delivers a malicious Word document can execute arbitrary code on the victim system, leading to full compromise of confidentiality, integrity, and availability under the user's privileges.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2019 (x64 and x86)
Microsoft Office Long Term Servicing Channel 2021 and 2024
Microsoft Word 2016 (x64 and x86)

Discovery Timeline

2025-07-08 - CVE-2025-49700 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49700

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in Microsoft Office Word. Use-after-free flaws occur when a program continues to reference memory after that memory has been released. An attacker who controls the contents and timing of allocations can place attacker-controlled data into the freed region. When Word later dereferences the stale pointer, it operates on attacker-controlled memory, which can be leveraged to redirect execution flow.

Because the vulnerable code path resides in document parsing or rendering logic within Word, the attack surface is exposed any time a user opens a crafted file. The result is local code execution in the context of the current user. The EPSS score is 0.381%, indicating low observed exploitation probability at this time.

Root Cause

The root cause is improper memory lifecycle management within Microsoft Office Word. A document object is freed while another code path still holds a reference to it. Subsequent operations on the dangling reference allow an attacker to corrupt program state and hijack control flow.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious .doc or .docx file and delivers it through email, file share, or web download. When the victim opens the document in a vulnerable version of Word, the parser triggers the use-after-free condition. No elevated privileges are required from the attacker prior to delivery.

Verified exploitation code is not publicly available. See the Microsoft Security Update for CVE-2025-49700 for vendor technical details.

Detection Methods for CVE-2025-49700

Indicators of Compromise

Microsoft Word (WINWORD.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Anomalous crashes of WINWORD.EXE with access violation exceptions shortly after a document is opened.
Word processes initiating outbound network connections to untrusted hosts immediately after document load.
Unexpected file writes to %APPDATA%, %TEMP%, or user startup folders originating from Word.

Detection Strategies

Hunt for parent-child process relationships where WINWORD.EXE launches scripting interpreters or LOLBins.
Correlate Office document open events with subsequent process creation, registry persistence, or network telemetry.
Inspect inbound email and file-share traffic for Office documents containing embedded objects, unusual OLE streams, or malformed structures.

Monitoring Recommendations

Enable and forward Microsoft-Windows-Sysmon and Office telemetry (process creation, image loads, file writes) to a centralized analytics platform.
Monitor Application event logs for WINWORK.EXE faulting modules and recurring crashes across endpoints.
Track execution of macros and ActiveX controls in Office documents from external sources.

How to Mitigate CVE-2025-49700

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-49700 to all affected Office installations.
Inventory endpoints for vulnerable versions of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Word 2016, and prioritize patching.
Enforce Protected View and Block macros from running in Office files from the Internet via Group Policy.

Patch Information

Microsoft has released security updates that address the use-after-free condition in Word. Administrators should deploy the relevant Office update through Microsoft Update, Microsoft 365 Apps update channels, or WSUS. Refer to the Microsoft Security Update for CVE-2025-49700 for build numbers and per-channel guidance.

Workarounds

Open untrusted documents only in Protected View and disable editing unless the source is verified.
Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes.
Use Exchange transport rules or secure email gateways to strip or quarantine Office attachments from external senders pending patch deployment.

bash

# Configuration example: Enable ASR rule to block Office child process creation
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled