CVE-2025-59229: Microsoft 365 Apps DOS Vulnerability

CVE-2025-59229 Overview

CVE-2025-59229 is a local denial-of-service vulnerability in Microsoft Office caused by an uncaught exception [CWE-248]. An unauthorized attacker can trigger the flaw by convincing a user to open a crafted document, causing the Office application to terminate unexpectedly. The vulnerability affects Microsoft 365 Apps and Microsoft Office Long Term Servicing Channel 2024 across x64 and x86 platforms. Exploitation requires user interaction but no privileges on the target system. Microsoft has published a security advisory addressing the issue.

Critical Impact
Successful exploitation causes high availability impact on the local Office application, disrupting document workflows without exposing confidentiality or integrity.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office Long Term Servicing Channel 2024 (x64)
Microsoft Office Long Term Servicing Channel 2024 (x86)

Discovery Timeline

2025-10-14 - CVE-2025-59229 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59229

Vulnerability Analysis

The vulnerability resides in Microsoft Office's handling of certain document inputs. Office code paths fail to catch an exception raised during parsing or rendering, resulting in unhandled process termination. The result is a denial-of-service condition affecting the local Office application. Because the attack vector is local and requires the user to open a malicious file, exploitation typically follows phishing or file-drop scenarios. No confidentiality or integrity impact is documented; the effect is limited to availability of the Office process on the victim host.

Root Cause

The root cause is an uncaught exception classified under [CWE-248]. Office code invokes an operation that raises an exception without a corresponding handler in the call stack. When the exception propagates unhandled, the runtime terminates the process. Well-formed exception handling around the affected parsing or rendering routine would allow Office to fail gracefully instead of crashing.

Attack Vector

An attacker crafts a malicious Office document and delivers it to a target user through email, file share, or web download. When the victim opens the document in an affected Office build, the parser encounters the malformed structure and raises an exception that Office does not catch. The Office process terminates, disrupting the user's work. The attack requires no authentication and no elevated privileges, only that the user interact with the file. Refer to the Microsoft Security Update Guide for vendor-supplied technical details.

Detection Methods for CVE-2025-59229

Indicators of Compromise

Unexpected termination of WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, or related Office binaries shortly after a document open event.
Windows Error Reporting or Application Event Log entries citing unhandled exceptions in Office processes.
Recently received Office documents from untrusted senders that consistently crash the application on open.

Detection Strategies

Correlate Office process crashes with recent file-open telemetry to identify documents that reliably trigger termination.
Hunt for Office child-process anomalies and repeated crash-restart patterns across users receiving similar attachments.
Inspect email gateway logs for clustered delivery of Office attachments preceding endpoint crash events.

Monitoring Recommendations

Ingest Windows Application and WER logs into a central log platform and alert on Office Faulting application events.
Monitor endpoints for a spike in Office process exits with non-zero exit codes across multiple users.
Track email and web downloads of Office file types (.docx, .xlsx, .pptx, .rtf) from external senders for later correlation.

How to Mitigate CVE-2025-59229

Immediate Actions Required

Apply the Microsoft update referenced in the Microsoft Security Update Guide to all affected Microsoft 365 Apps and Office LTSC 2024 installations.
Verify Office click-to-run update channels are enabled and current on managed endpoints.
Advise users to avoid opening unsolicited Office attachments until patching is complete.

Patch Information

Microsoft has released a fix for CVE-2025-59229. Administrators should deploy the latest cumulative update for Microsoft 365 Apps and for Microsoft Office Long Term Servicing Channel 2024 on both x64 and x86 architectures. Consult the Microsoft Security Update Guide for build numbers and channel-specific guidance.

Workarounds

Enable Protected View for files originating from the internet and other untrusted locations to constrain document processing.
Enforce Office attack surface reduction rules and block macros in files from the internet via Group Policy or Intune.
Use email gateway policies to filter or sandbox inbound Office attachments from external senders while patch rollout is pending.

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f