CVE-2025-62205: Microsoft 365 Apps Use-After-Free Flaw

CVE-2025-62205 Overview

CVE-2025-62205 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word. An unauthorized attacker can execute arbitrary code locally on a victim's system after the user opens a crafted document. The flaw affects Microsoft 365 Apps and Microsoft Office Long Term Servicing Channel (LTSC) 2021 and 2024 in both x86 and x64 builds.

The vulnerability requires local access and user interaction, typically delivered through a malicious Word document opened by the target. Successful exploitation grants the attacker the privileges of the current user, with high impact to confidentiality, integrity, and availability.

Critical Impact
Opening a malicious Word document allows an attacker to execute code in the security context of the current user, enabling malware deployment, credential theft, and lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office LTSC 2021 (x86 and x64)
Microsoft Office LTSC 2024 (x86 and x64)

Discovery Timeline

2025-11-11 - CVE-2025-62205 published to the National Vulnerability Database
2025-11-11 - Microsoft releases security update for CVE-2025-62205
2025-11-17 - Last updated in NVD database

Technical Details for CVE-2025-62205

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] within Microsoft Office Word. Use-after-free flaws occur when a program references memory that has already been freed, allowing an attacker to influence the contents of the freed allocation before the dangling pointer is dereferenced.

In this case, processing logic in Word releases an object while another code path retains a reference to it. An attacker who shapes the heap with a crafted document can replace the freed allocation with controlled data. When Word later operates on the stale pointer, the attacker-controlled data drives execution flow, leading to arbitrary code execution in the user's context.

The attack vector is local and requires user interaction. The victim must open the malicious file, typically delivered through email attachments, phishing links, or shared file repositories. No elevated privileges are required to trigger the flaw.

Root Cause

The root cause is improper lifetime management of an internal Word object. The application frees the underlying memory but continues to hold or revisit a pointer to it, violating safe reuse semantics for that allocation.

Attack Vector

An attacker crafts a Word document containing malformed structures that trigger the vulnerable code path. The document grooms the heap and reclaims the freed object with attacker-controlled content. When Word dereferences the stale pointer, execution transfers to attacker-supplied data, achieving local code execution. Refer to the Microsoft Security Update for CVE-2025-62205 for vendor technical context.

Detection Methods for CVE-2025-62205

Indicators of Compromise

Microsoft Word (winword.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe
Word loading unusual DLLs or writing executable files to %TEMP%, %APPDATA%, or %PROGRAMDATA%
Outbound network connections originating from winword.exe to untrusted destinations shortly after document open
Abnormal crashes of winword.exe with access violations consistent with use-after-free conditions

Detection Strategies

Hunt for parent-child process relationships where winword.exe launches scripting interpreters or LOLBins
Apply Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting code into other processes
Inspect documents from external sources for embedded objects, macros, and OLE structures known to trigger memory corruption

Monitoring Recommendations

Forward Sysmon and EDR telemetry for winword.exe process creation, image loads, and file writes to centralized analytics
Alert on Word crashes (Application Error event ID 1000 with faulting module in Office binaries) that may indicate exploitation attempts
Correlate document open events with subsequent network egress and persistence-related registry or scheduled task modifications

How to Mitigate CVE-2025-62205

Immediate Actions Required

Apply the Microsoft security update for CVE-2025-62205 to all affected Microsoft 365 Apps and Office LTSC 2021 and 2024 installations
Enable Protected View and Office Application Guard for documents originating from the internet or email
Block or quarantine inbound Word documents from untrusted senders at the email gateway until patches are deployed
Educate users to avoid opening unexpected .doc, .docx, or .docm attachments

Patch Information

Microsoft has released a security update addressing CVE-2025-62205. Administrators should consult the Microsoft Security Update for CVE-2025-62205 for build numbers and deployment guidance across Microsoft 365 Apps and Office LTSC 2021 and 2024.

Workarounds

Enforce Protected View for files originating from the Internet Zone, Outlook attachments, and unsafe locations
Deploy Microsoft Defender ASR rules D4F940AB-401B-4EFC-AADC-AD5F3C50688A (block Office child processes) and 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 (block Office from creating executable content)
Restrict execution of Office macros from the internet through Group Policy
Open untrusted documents in a sandboxed environment or a non-privileged user account

bash

# Configuration example: enable Defender ASR rules to block Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

Set-MpPreference -AttackSurfaceReductionRules_Ids `
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled