CVE-2025-54910: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2025-54910 Overview

CVE-2025-54910 is a heap-based buffer overflow vulnerability [CWE-122] in Microsoft Office that allows an unauthorized attacker to execute arbitrary code locally. The flaw affects Microsoft 365 Apps, Microsoft Office 2016, Office 2019, and the Office Long Term Servicing Channel (LTSC) 2021 and 2024 builds on both Windows and macOS. Microsoft published the advisory on September 9, 2025. Successful exploitation grants the attacker the same privileges as the targeted user, with high impact to confidentiality, integrity, and availability. No public proof-of-concept code or in-the-wild exploitation has been reported at the time of writing.

Critical Impact
Code execution in the context of the current user across Microsoft 365 Apps, Office 2016/2019, and Office LTSC 2021/2024, enabling local compromise without authentication.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2016 and Microsoft Office 2019 (x86 and x64)
Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024 (Windows x86/x64 and macOS)

Discovery Timeline

2025-09-09 - CVE-2025-54910 published to NVD
2025-09-09 - Microsoft releases security advisory and patch
2025-09-12 - Last updated in NVD database

Technical Details for CVE-2025-54910

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Office's document parsing logic. An attacker crafts a malicious Office document that, when opened, causes Office to write past the bounds of a heap-allocated buffer. The corrupted heap state can be shaped to overwrite adjacent objects, function pointers, or vtables used during further parsing. Exploitation yields arbitrary code execution in the context of the user running Office. Because the attack vector is local and requires no privileges or user interaction beyond opening a document, weaponized documents delivered via email, file shares, or web downloads are practical delivery channels. The EPSS probability is currently 0.147%, but the impact metrics (C:H/I:H/A:H) indicate full compromise of the user session on successful exploitation.

Root Cause

The root cause is improper validation of input sizes when Office allocates and populates a heap buffer during file parsing. A specially crafted record or embedded object supplies length or count fields that bypass bounds checks, causing the parser to copy more data than the destination buffer can hold. This classic [CWE-122] heap overflow corrupts adjacent allocator metadata or in-line object data, which the attacker leverages to redirect execution flow.

Attack Vector

The attack vector is local: the attacker must induce the victim to open a malicious Office file on a system with a vulnerable version of Microsoft Office, Microsoft 365 Apps, or Office LTSC. No authentication or user interaction beyond opening the document is required by the CVSS metrics. Common delivery mechanisms include phishing attachments, malicious links to documents on attacker-controlled or compromised file hosting, and removable media. Protected View and Mark-of-the-Web can reduce, but do not eliminate, exploitability depending on user actions.

No public proof-of-concept code is available. Refer to the Microsoft Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-54910

Indicators of Compromise

Microsoft Office processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, OUTLOOK.EXE) crashing with heap corruption exceptions such as STATUS_HEAP_CORRUPTION (0xC0000374) shortly after opening a document.
Office applications spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Office processes writing executable files (.exe, .dll, .ps1, .hta) to user-writable paths such as %TEMP%, %APPDATA%, or %LOCALAPPDATA%.
Outbound network connections originating from Office processes to unfamiliar hosts immediately after a document is opened.

Detection Strategies

Hunt for Office binaries acting as parent processes for script interpreters or living-off-the-land binaries (LOLBins).
Monitor for image loads of unsigned or recently dropped DLLs into Office processes.
Alert on documents arriving via email with oleObject, OLEPackage, or embedded equation/legacy formats that exercise the affected parsers.
Correlate Windows Error Reporting (WerFault.exe) events for Office crashes with subsequent suspicious activity on the same host.

Monitoring Recommendations

Forward Sysmon process creation, image load, and file write events from endpoints running Office to a centralized analytics platform.
Track Office version inventory across managed endpoints to identify hosts still running unpatched builds.
Enable and review Attack Surface Reduction (ASR) rule audit logs, particularly the rule blocking Office applications from creating child processes.

How to Mitigate CVE-2025-54910

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Advisory to all affected Office and Microsoft 365 Apps installations.
Verify Microsoft 365 Apps clients are receiving updates from the Current, Monthly Enterprise, or Semi-Annual Enterprise channel and force an update check on hosts that report stale versions.
Restrict opening of Office documents originating from untrusted sources until patching is verified across the estate.

Patch Information

Microsoft addressed CVE-2025-54910 in the September 2025 security update cycle. Update paths cover Microsoft 365 Apps for Enterprise (x86 and x64), Microsoft Office 2016 and 2019, and Microsoft Office LTSC 2021 and 2024 on Windows and macOS. Click-to-Run customers receive the fix through the standard Office update channels. Volume-licensed Office 2016/2019 and LTSC installations require the corresponding MSP packages from the Microsoft Update Catalog. Validate the post-update version string in File > Account > About matches or exceeds the build listed in the advisory.

Workarounds

Enable Protected View and Office Protected View for files originating from the Internet, Outlook attachments, and potentially unsafe locations.
Configure ASR rule Block all Office applications from creating child processes (GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A) in Block mode.
Disable legacy file format parsing through File Block policy for .doc, .xls, and .ppt formats where business workflows permit.
Deliver Office documents through controlled rendering services or sandboxed viewers when patching cannot be completed immediately.

bash

# Configuration example: enable the ASR rule that blocks Office child processes (PowerShell, run as Administrator)
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify enforcement state
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions