CVE-2025-54906: Microsoft 365 Apps RCE Vulnerability

CVE-2025-54906 Overview

CVE-2025-54906 is a local code execution vulnerability in Microsoft Office caused by freeing memory that was not allocated on the heap. The flaw is categorized as a use-after-free condition [CWE-416] affecting multiple Office product lines, including Microsoft 365 Apps, Office 2016, Office 2019, Office LTSC 2021/2024, and SharePoint Server 2016/2019. An attacker who convinces a user to open a crafted Office document can execute arbitrary code in the context of the current user.

Critical Impact

Successful exploitation grants the attacker full code execution with the privileges of the targeted user, leading to confidentiality, integrity, and availability compromise on the affected host.

Affected Products

• Microsoft 365 Apps (Enterprise, x86 and x64)
• Microsoft Office 2016 and Office 2019 (x86 and x64)
• Microsoft Office LTSC 2021 and LTSC 2024 (Windows and macOS)
• Microsoft SharePoint Server 2016 and 2019

Discovery Timeline

• 2025-09-09 - CVE-2025-54906 published to NVD
• 2025-09-12 - Last updated in NVD database

Technical Details for CVE-2025-54906

Vulnerability Analysis

The vulnerability stems from Microsoft Office attempting to free a memory region that was not allocated on the heap. When the application's deallocation routine processes a pointer referencing stack memory, a static buffer, or memory already released, the heap manager's internal bookkeeping is corrupted. This condition is classified under [CWE-416] use-after-free behavior and creates an exploitable memory corruption primitive. Attackers leverage the corruption to overwrite control structures and redirect execution flow. The result is arbitrary code execution within the same security context as the user opening the document.

Root Cause

The root cause is improper memory management within an Office parsing or rendering component. The code path passes a non-heap pointer to a free()-equivalent routine, violating allocator invariants. Crafted document structures trigger the unsafe deallocation, producing a controllable memory corruption state.

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a weaponized Office document through email, web download, or a shared file location. When the victim opens the file in a vulnerable Office application, the malformed object triggers the invalid free during parsing. The attacker then leverages the memory corruption to execute code as the logged-on user. No prior authentication on the target host is required beyond the user opening the file.

No verified public exploit code is currently available. For additional technical detail, refer to the Microsoft Security Update CVE-2025-54906 advisory.

Detection Methods for CVE-2025-54906

Indicators of Compromise

• Office documents (.docx, .xlsx, .pptx, .rtf, and legacy binary formats) originating from untrusted senders or web sources.
• Unexpected crashes of winword.exe, excel.exe, or powerpnt.exe followed by suspicious child process creation.
• Office applications spawning shells, scripting hosts (powershell.exe, cmd.exe, wscript.exe), or rundll32.exe.

Detection Strategies

• Hunt for parent-child process relationships where Office binaries spawn command interpreters or LOLBins.
• Monitor for Office processes loading unsigned DLLs or writing executables to user-writable directories.
• Inspect Office documents for embedded objects, malformed OLE streams, or anomalous structured-storage entries consistent with memory corruption triggers.

Monitoring Recommendations

• Enable and forward Microsoft Defender Antimalware Scan Interface (AMSI) and Office telemetry to a centralized SIEM for correlation.
• Track Windows Error Reporting (WER) events for winword.exe, excel.exe, and powerpnt.exe crashes that may indicate exploitation attempts.
• Alert on Office processes establishing outbound network connections to non-Microsoft destinations shortly after document open events.

How to Mitigate CVE-2025-54906

Immediate Actions Required

• Apply the September 2025 Microsoft Office security updates referenced in the Microsoft Security Update CVE-2025-54906 advisory.
• Prioritize patching endpoints used by high-risk roles such as executives, finance, and HR who frequently open external documents.
• Block inbound Office attachments from untrusted senders at the email gateway pending patch deployment.

Patch Information

Microsoft has released security updates for all affected products through the Microsoft Update Guide. Administrators should deploy the corresponding updates via Microsoft Update, WSUS, Microsoft Configuration Manager, or Intune. SharePoint Server updates must be applied to all farm servers and followed by the SharePoint Products Configuration Wizard.

Workarounds

• Enforce Protected View and Office Application Guard for documents originating from the internet or other untrusted locations.
• Disable macros and ActiveX content by default through Group Policy for all Office applications.
• Restrict execution of child processes from Office applications using Microsoft Defender Attack Surface Reduction (ASR) rules.

# Configuration example: Enable ASR rule blocking Office child process creation
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled