CVE-2025-53738: Microsoft 365 Apps Use-After-Free RCE

CVE-2025-53738 Overview

CVE-2025-53738 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word. The flaw allows an unauthorized attacker to execute arbitrary code locally on a target system. Exploitation requires user interaction, typically opening a malicious Word document. The affected products include Microsoft 365 Apps, Microsoft Office 2019, Microsoft Office LTSC 2021 and 2024, and Microsoft Word 2016 on both Windows and macOS platforms.

Microsoft published the advisory on August 12, 2025. The vulnerability carries a CVSS v3.1 base score of 7.8 and impacts confidentiality, integrity, and availability. No public proof-of-concept exploit or active exploitation has been reported at the time of disclosure.

Critical Impact
Successful exploitation grants code execution in the context of the user running Word, enabling malware installation, credential theft, and lateral movement from a single weaponized document.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (Windows and macOS)
Microsoft Word 2016 (x86 and x64)

Discovery Timeline

2025-08-12 - CVE-2025-53738 published to NVD
2025-08-12 - Microsoft releases security patch via Patch Tuesday
2025-08-18 - Last updated in NVD database

Technical Details for CVE-2025-53738

Vulnerability Analysis

The vulnerability is a use-after-free condition in Microsoft Word's document parsing logic. Word allocates memory objects to represent document structures during file parsing. The flaw occurs when Word references a memory object that has already been freed, allowing an attacker to control the contents of that freed region.

An attacker crafts a malicious .doc or .docx file containing structures that trigger premature object deallocation. When Word later dereferences the dangling pointer, the attacker-controlled data is interpreted as a valid object. This redirects execution flow into attacker-supplied shellcode.

The Preview Pane in Windows Explorer and Outlook may render Word content automatically, broadening the exploitation surface beyond explicit document opens. Code executes under the privileges of the logged-on user.

Root Cause

The root cause is improper object lifetime management within Word's parser [CWE-416]. The parser fails to invalidate or null out references to memory objects after they are freed, leaving stale pointers that can be reused during subsequent operations on the document.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious Word document through email, web download, or shared storage. When the victim opens or previews the file, the use-after-free triggers and the embedded payload executes. The EPSS score for this CVE is 0.485%.

No verified public exploit code is available. The vulnerability mechanism is described in prose only — see the Microsoft CVE-2025-53738 Advisory for vendor technical details.

Detection Methods for CVE-2025-53738

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Word process crashes with access violation exceptions in the Windows Application event log immediately before suspicious process activity.
Outbound network connections originating from WINWORD.EXE to unfamiliar domains or IP addresses.
Creation of executables, scripts, or scheduled tasks in user profile directories shortly after opening a Word document.

Detection Strategies

Monitor parent-child process relationships and alert on Office applications launching script interpreters or shells.
Inspect inbound .doc, .docx, and .rtf attachments with sandbox detonation to surface exploitation attempts before delivery.
Hunt for anomalous memory regions or thread injection within WINWORD.EXE using EDR memory telemetry.
Correlate Word crash events with subsequent file writes or persistence mechanisms on the same host.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes.
Forward Office telemetry, Sysmon process events, and Windows Defender exploit guard logs to a centralized analytics platform.
Track download sources and email gateway logs for documents originating from low-reputation senders or external sharing platforms.

How to Mitigate CVE-2025-53738

Immediate Actions Required

Apply the August 2025 Microsoft security updates to every affected Office and Microsoft 365 Apps installation without delay.
Inventory endpoints running Office 2016, 2019, LTSC 2021, and LTSC 2024 to confirm patch coverage on both Windows and macOS.
Block or quarantine inbound Word documents from untrusted external sources at the email gateway.
Disable the Preview Pane in Outlook and Windows Explorer on high-risk endpoints until patching is complete.

Patch Information

Microsoft addressed CVE-2025-53738 in the August 2025 security update cycle. Refer to the Microsoft CVE-2025-53738 Advisory for product-specific update KB numbers and build versions. Microsoft 365 Apps users receive the fix through the standard Click-to-Run update channel.

Workarounds

Configure Office Protected View to open all documents originating from the internet and email attachments in an isolated sandbox.
Enforce the Office macro execution policy to block macros in files from the internet via Group Policy.
Deploy Attack Surface Reduction rules to prevent Office applications from creating executable content or spawning child processes.
Restrict the file types allowed through email gateways and require sandbox inspection of all Office attachments from external senders.

bash

# Configuration example: enable ASR rule blocking Office child processes (PowerShell)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

# Verify enforcement
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids