CVE-2025-54907: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2025-54907 Overview

CVE-2025-54907 is a heap-based buffer overflow [CWE-122] in Microsoft Office Visio that allows an unauthorized attacker to execute arbitrary code locally. The flaw affects Microsoft 365 Apps, Microsoft Office 2019, and Microsoft Office Long Term Servicing Channel (LTSC) 2021 and 2024 on both x86 and x64 platforms. Exploitation requires user interaction, typically by opening a crafted Visio document. Successful exploitation yields high impact to confidentiality, integrity, and availability of the affected host.

Critical Impact
An attacker who convinces a user to open a malicious Visio file can execute code in the context of the current user, leading to full compromise of the user session.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019 (x86 and x64)
Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024 (x86 and x64)

Discovery Timeline

2025-09-09 - CVE-2025-54907 published to the National Vulnerability Database (NVD)
2025-09-12 - Last updated in the NVD database

Technical Details for CVE-2025-54907

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in the Microsoft Office Visio component. Office writes attacker-controlled data past the bounds of a heap-allocated buffer while parsing a malformed Visio document. The overflow corrupts adjacent heap metadata or object pointers within the Office process. An attacker can shape heap layout to gain control of execution flow and run native code in the user's security context. The defect is reachable through standard Visio file parsing paths invoked by opening or previewing a document.

Root Cause

The root cause is improper validation of size or length fields when copying structured data into a fixed-size heap buffer inside the Visio parser. Insufficient bounds checking allows oversized records in the Visio file format to overflow the destination buffer. This class of defect typically arises from trusting length prefixes encoded in untrusted input.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted .vsd, .vsdx, or related Visio file via email, web download, or shared storage. When the user opens the file in a vulnerable Office installation, the parser triggers the overflow. No prior authentication to the target is required, and exploitation grants code execution at the privilege level of the user opening the document.

No verified public proof-of-concept is available. See the Microsoft CVE-2025-54907 Update for vendor technical details.

Detection Methods for CVE-2025-54907

Indicators of Compromise

Unexpected child processes spawned by VISIO.EXE or other Office processes, such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
Office processes writing executable content to %TEMP%, %APPDATA%, or user profile directories shortly after opening a Visio file.
Inbound Visio attachments (.vsd, .vsdx, .vsdm) from untrusted senders, particularly with macros or embedded objects.
Crash events or Windows Error Reporting entries referencing heap corruption in VISIO.EXE or associated Office DLLs.

Detection Strategies

Hunt for process trees where VISIO.EXE is the parent of script interpreters or LOLBins.
Alert on outbound network connections initiated by VISIO.EXE to non-Microsoft destinations.
Monitor for DLL loads from user-writable paths into Office processes after document open events.
Apply YARA or content rules to mail and web gateways to identify malformed Visio files with oversized structural records.

Monitoring Recommendations

Centralize Office telemetry, including process creation, image load, and file write events, into a SIEM or data lake for correlation.
Track patch deployment status for Microsoft 365 Apps and Office LTSC builds across the fleet to surface unpatched endpoints.
Review Windows Defender Application Control or AppLocker logs for blocked execution attempts originating from Office processes.

How to Mitigate CVE-2025-54907

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2025-54907 Update advisory to all affected installations.
Inventory Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024 deployments and prioritize patching of systems that process external Visio files.
Block or quarantine inbound .vsd, .vsdx, and .vsdm attachments from untrusted senders at the mail gateway pending patch deployment.
Brief users on the risk of opening unsolicited Visio documents and enforce Protected View for files originating from the internet.

Patch Information

Microsoft addressed CVE-2025-54907 in the September 2025 security updates for Microsoft 365 Apps, Office 2019, and Office LTSC 2021 and 2024. Administrators should consult the vendor advisory for the specific KB articles and build numbers that correspond to each channel. Click-to-Run installations should be updated through the Office update channel, and LTSC builds through Microsoft Update or Windows Server Update Services (WSUS).

Workarounds

Enable Protected View and Office Application Guard for documents originating from email and the internet.
Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from injecting code into other processes.
Restrict execution of Visio on systems that do not require it, or remove Visio from base images where it is not used.
Enforce mark-of-the-web (MOTW) propagation so that downloaded Visio files open in a restricted parsing mode.

bash

# Example: enable the ASR rule that blocks Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled