CVE-2025-62555: Microsoft 365 Apps Use-After-Free Flaw

CVE-2025-62555 Overview

CVE-2025-62555 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word that allows an unauthorized attacker to execute code locally. The flaw affects Microsoft 365 Apps, Microsoft Office 2019, Microsoft Office Long Term Servicing Channel (LTSC) 2021 and 2024, Microsoft Word 2016, and Microsoft SharePoint Server 2016 and 2019. Exploitation requires user interaction, typically opening a crafted document. Microsoft published the advisory on December 9, 2025.

Critical Impact
Successful exploitation results in arbitrary code execution in the context of the user running Word, with high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024 (including macOS builds)
Microsoft Word 2016 and Microsoft SharePoint Server 2016 / 2019

Discovery Timeline

2025-12-09 - Microsoft releases security advisory for CVE-2025-62555
2025-12-09 - CVE-2025-62555 published to NVD
2025-12-10 - Last updated in NVD database

Technical Details for CVE-2025-62555

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] within Microsoft Office Word's document parsing and rendering logic. Use-after-free flaws occur when a program continues to reference memory after it has been released back to the allocator. An attacker who controls the freed object's contents can hijack control flow when Word later dereferences the dangling pointer.

Exploitation requires the victim to open a specially crafted Word document. The attack vector is local, meaning the attacker delivers the malicious file via email attachment, web download, or shared storage. Word also renders documents in SharePoint Server contexts, expanding the exposure surface to server-side document processing where supported.

Successful exploitation grants arbitrary code execution in the security context of the user running Word. From that foothold, attackers can drop malware, harvest credentials, or pivot to additional resources accessible to the user.

Root Cause

The root cause is improper object lifetime management within Word's document handling code. A specific object is freed while a pointer to it remains in use. When the application later operates on that pointer, attacker-controlled heap data is treated as a valid object, enabling control over virtual function dispatch or other indirect operations.

Attack Vector

The attack is local and requires user interaction. A typical chain involves a phishing email containing a weaponized .docx, .doc, or RTF document. When the user opens the file or, in some configurations, views it in the Preview pane, Word triggers the vulnerable code path. The attacker must also win a race or heap-grooming condition, reflected in the higher attack complexity. No verified public proof-of-concept code is available at this time.

No verified proof-of-concept code is publicly available.
Refer to the Microsoft Security Response Center advisory for technical details.

Detection Methods for CVE-2025-62555

Indicators of Compromise

Unexpected child processes spawned by winword.exe, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Word writing or executing binaries from %TEMP%, %APPDATA%, or user profile directories.
Outbound network connections initiated directly by winword.exe to untrusted destinations.
Crash dumps for winword.exe referencing access violations in document parsing components.

Detection Strategies

Hunt for process-tree anomalies where Office applications spawn scripting hosts or shells, which is a strong post-exploitation signal for Office memory-corruption bugs.
Inspect inbound email attachments and SharePoint uploads for Word documents containing unusual embedded objects, ActiveX controls, or malformed structures.
Correlate Word crashes (Windows Error Reporting events) with subsequent suspicious activity on the same host within a short time window.

Monitoring Recommendations

Enable and forward Microsoft Defender ASR rule telemetry, particularly rules that block Office child-process creation and executable content from email.
Centralize endpoint process, file, and network telemetry to a SIEM or data lake to support retrospective hunts as new IOCs emerge.
Monitor SharePoint Server document-processing services for w3wp.exe or related worker process crashes tied to Word rendering.

How to Mitigate CVE-2025-62555

Immediate Actions Required

Apply Microsoft's December 2025 security updates to all affected Office, Microsoft 365 Apps, Word 2016, and SharePoint Server installations.
Inventory endpoints and servers running affected SKUs, including Office LTSC 2021/2024 on macOS, and prioritize internet-facing and high-privilege users.
Enforce Protected View and Office macro restrictions for documents originating from the internet or email.

Patch Information

Microsoft has released security updates addressing CVE-2025-62555. Refer to the Microsoft CVE-2025-62555 Advisory for the full list of update packages per product and channel. Click-to-Run installations of Microsoft 365 Apps update automatically once the relevant channel build is available.

Workarounds

Block or quarantine inbound Office documents from external senders at the mail gateway until patches are deployed.
Enable Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.
Open untrusted documents only in Protected View and disable the Outlook Preview pane for unpatched hosts.

bash

# Configuration example: enforce ASR rule blocking Office child-process creation
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled