CVE-2025-62552 Overview
CVE-2025-62552 is a relative path traversal vulnerability [CWE-23] in Microsoft Office Access that allows an unauthorized attacker to execute code locally. The flaw affects multiple Microsoft Office product lines, including Microsoft 365 Apps, Microsoft Access 2016, Microsoft Office 2019, and Microsoft Office Long Term Servicing Channel (LTSC) 2021 and 2024. Exploitation requires user interaction, meaning a victim must open a crafted file or take another action initiated by the attacker. Successful exploitation results in arbitrary code execution in the context of the current user.
Critical Impact
Successful exploitation grants the attacker the ability to run arbitrary code on the target host with the privileges of the user who opened the malicious file, enabling persistence, lateral movement, or data theft.
Affected Products
- Microsoft 365 Apps (Enterprise, x64 and x86)
- Microsoft Access 2016, Microsoft Office 2019 (x64 and x86)
- Microsoft Office LTSC 2021 and 2024 (x64 and x86)
Discovery Timeline
- 2025-12-09 - CVE-2025-62552 published to NVD
- 2025-12-09 - Last updated in NVD database
Technical Details for CVE-2025-62552
Vulnerability Analysis
The vulnerability is classified as relative path traversal [CWE-23] within Microsoft Office Access. The application fails to properly sanitize file path references when handling specific document constructs. An attacker crafts a document or database file that includes path components such as ..\ sequences pointing outside the intended working directory. When the victim opens the file, Access resolves the manipulated path and loads or writes resources to an attacker-controlled location, leading to local code execution in the context of the current user.
Root Cause
The root cause is improper validation of user-supplied path strings before they are passed to file-handling routines inside Microsoft Access. Because the parser does not normalize or restrict relative path segments, embedded traversal sequences let the application reach files outside the expected sandbox directory. Microsoft has not published low-level technical details; refer to the Microsoft Security Update Guide for vendor analysis.
Attack Vector
The attack vector is local and requires user interaction. An attacker must deliver a malicious Access database or Office document to the target user, typically through phishing email, a shared drive, or a download link. When the user opens the file, Access processes the embedded path traversal payload and executes attacker-supplied code with the user's privileges. The attacker does not need prior credentials or any network foothold.
Detection Methods for CVE-2025-62552
Indicators of Compromise
- Microsoft Access (MSACCESS.EXE) spawning child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
- Access database files (.accdb, .mdb, .accde) containing relative path sequences (..\ or ../) in linked tables or external references
- New executables or scripts written outside the user's Documents or temp directories shortly after an Office file is opened
- Unexpected outbound network connections originating from MSACCESS.EXE
Detection Strategies
- Inspect Office documents and Access database files received from external sources for embedded relative path strings before they reach end users
- Hunt for process lineage where MSACCESS.EXE is the parent of script interpreters or LOLBins
- Correlate file-write events from Office processes against directories outside standard user paths
Monitoring Recommendations
- Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and writing executable content
- Forward Sysmon process creation (Event ID 1) and file creation (Event ID 11) data from endpoints running Office to a centralized SIEM for correlation
- Track Office telemetry for opens of .accdb and .mdb files originating from email attachments or internet-zone locations
How to Mitigate CVE-2025-62552
Immediate Actions Required
- Apply the December 2025 Microsoft security updates referenced in the Microsoft Security Update Guide for CVE-2025-62552 to all affected Office installations
- Inventory endpoints running Microsoft 365 Apps, Access 2016, Office 2019, and Office LTSC 2021/2024 and prioritize patch deployment
- Block inbound Access database file types (.accdb, .mdb, .accde) at the email gateway unless required for business operations
Patch Information
Microsoft has released a security update addressing CVE-2025-62552. Administrators should install the patch through Microsoft Update, Windows Update for Business, WSUS, Microsoft Intune, or Configuration Manager. Full advisory and build numbers are listed in the Microsoft Security Update Guide.
Workarounds
- Enable Protected View and Office File Block policies to prevent files from untrusted locations from opening with full functionality
- Restrict execution of macros and embedded code in Office documents through Group Policy until patches are deployed
- Train users to avoid opening Access database files received from unverified senders or external file shares
# Verify Microsoft 365 Apps build via PowerShell after patching
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" |
Select-Object ProductReleaseIds, VersionToReport, Platform
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
