CVE-2025-53733: Microsoft 365 Apps RCE Vulnerability

CVE-2025-53733 Overview

CVE-2025-53733 is a local code execution vulnerability in Microsoft Office Word caused by an incorrect conversion between numeric types [CWE-681]. The flaw affects multiple Microsoft Office products including Microsoft 365 Apps, Office 2019, Office LTSC 2021 and 2024, Word 2016, and SharePoint Server editions that process Word document content. An attacker who successfully exploits the issue can run arbitrary code in the context of the targeted user. Microsoft assigned the vulnerability a CVSS 3.1 score of 8.4 and rates the impact as High across confidentiality, integrity, and availability.

Critical Impact

Successful exploitation grants the attacker code execution on the local system without authentication or user interaction, with high impact on confidentiality, integrity, and availability.

Affected Products

• Microsoft 365 Apps (Enterprise, x64 and x86)
• Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (Windows and macOS variants)
• Microsoft Word 2016, SharePoint Server 2019, and SharePoint Enterprise Server 2016

Discovery Timeline

• 2025-08-12 - CVE-2025-53733 published to NVD
• 2025-08-18 - Last updated in NVD database

Technical Details for CVE-2025-53733

Vulnerability Analysis

The vulnerability is classified under [CWE-681] Incorrect Conversion between Numeric Types. Word performs a numeric type conversion during document parsing that fails to preserve the original value semantics. When a crafted Word file is processed, the converted numeric value drives downstream operations such as buffer sizing, offset arithmetic, or object indexing. The mismatch creates an exploitable memory corruption condition that the attacker steers toward arbitrary code execution.

The attack vector is local, but no privileges and no user interaction are required for exploitation according to the CVSS vector. In practical terms, opening or previewing a malicious document through automated handlers, mail clients, or the Outlook Preview Pane can trigger the parser path. SharePoint Server is listed among affected products because server-side document processing reaches the same vulnerable code path.

Root Cause

The root cause is an unsafe numeric conversion in Word's document parsing logic. A wider integer is narrowed, or a signed value is reinterpreted as unsigned, without validating that the resulting value fits within the expected range. Subsequent code paths trust the converted value, producing incorrect memory layout decisions that an attacker can shape with crafted file structures.

Attack Vector

An attacker delivers a malicious .doc or .docx file through email, file share, or a SharePoint upload. When Word, an Office host, or a SharePoint server processes the document, the flawed conversion executes. The attacker controls the resulting memory state and redirects execution to attacker-supplied payloads, yielding code execution under the identity of the Word process.

No verified proof-of-concept exploit is publicly available. The vulnerability mechanism is described in prose because no validated exploit code has been released. Refer to the Microsoft CVE-2025-53733 Advisory for vendor technical guidance.

Detection Methods for CVE-2025-53733

Indicators of Compromise

• Unexpected child processes spawned by winword.exe, excel.exe, or other Office hosts, particularly cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
• Word documents originating from external email or web sources that contain malformed structures, oversized embedded objects, or anomalous numeric fields.
• New persistence artifacts in HKCU\Software\Microsoft\Office keys or scheduled tasks created shortly after a document open event.

Detection Strategies

• Hunt for Office processes loading uncommon DLLs from user-writable directories such as %APPDATA% or %TEMP%.
• Correlate document open telemetry with outbound network connections to non-corporate destinations within seconds of file access.
• Inspect SharePoint server processes for crash signatures or worker process restarts triggered by uploaded Word documents.

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and injecting into other processes.
• Forward Office telemetry, Sysmon process and image-load events, and EDR alerts to a central data lake for correlation across endpoints and SharePoint hosts.
• Track Word and Office build numbers across the fleet to confirm patch deployment status and flag unpatched hosts.

How to Mitigate CVE-2025-53733

Immediate Actions Required

• Apply the August 2025 Microsoft security updates referenced in the Microsoft CVE-2025-53733 Advisory to all affected Office, Microsoft 365 Apps, Word, and SharePoint installations.
• Prioritize patching of SharePoint Server 2019 and SharePoint Enterprise Server 2016 because server-side document processing exposes the vulnerable parser to untrusted uploads.
• Block inbound Word documents from untrusted senders at the email gateway until patches are confirmed deployed.

Patch Information

Microsoft has published security updates for all affected products. Administrators should consult the Microsoft CVE-2025-53733 Advisory for the specific KB articles and build numbers that remediate the issue across Microsoft 365 Apps, Office 2019, Office LTSC 2021, Office LTSC 2024, Word 2016, and the listed SharePoint Server versions.

Workarounds

• Enforce Protected View and Office Application Guard for documents originating from the internet or email attachments.
• Disable the Outlook Preview Pane to prevent automatic rendering of incoming Word attachments on unpatched hosts.
• Restrict macro execution and Office add-ins through Group Policy until patching completes across the environment.

# Configuration example: enable Protected View for documents from the internet via registry
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f