CVE-2025-62558 Overview
CVE-2025-62558 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word that enables local code execution. An unauthorized attacker can execute arbitrary code in the context of the current user after the victim opens a crafted document. The flaw affects multiple Microsoft Office variants including Microsoft 365 Apps, Office 2019, Office Long Term Servicing Channel (LTSC) 2021 and 2024, Word 2016, and SharePoint Server 2016 and 2019. Microsoft published the advisory on December 9, 2025.
Critical Impact
Successful exploitation allows arbitrary code execution with the privileges of the user opening a malicious document, leading to full compromise of confidentiality, integrity, and availability on the affected host.
Affected Products
- Microsoft 365 Apps (Enterprise, x64 and x86)
- Microsoft Office 2019, Office LTSC 2021 and 2024 (Windows and macOS)
- Microsoft Word 2016 and Microsoft SharePoint Server 2016/2019
Discovery Timeline
- 2025-12-09 - CVE-2025-62558 published to NVD
- 2025-12-10 - Last updated in NVD database
Technical Details for CVE-2025-62558
Vulnerability Analysis
The vulnerability is a use-after-free condition [CWE-416] within Microsoft Office Word's document parsing logic. Use-after-free occurs when a program continues to reference memory after it has been freed. When the freed allocation is reclaimed and populated with attacker-controlled data, dereferencing the stale pointer can redirect execution flow. In Word, this typically allows arbitrary code execution in the security context of the user who opened the document.
The issue requires user interaction. A target must open a specially crafted Word document, or preview it in a component that triggers the vulnerable code path. Because SharePoint Server is also listed as affected, server-side document handling pipelines that render or parse Word content can reach the vulnerable routine. The attack vector is local, meaning exploitation occurs through file processing on the target host rather than a network service listener.
Root Cause
The root cause is improper object lifetime management inside the Word file parser. A heap object is freed while another code path still holds a reference to it. Subsequent operations on the dangling pointer can be steered by document content to control function pointers, virtual method tables, or other dispatch structures. Microsoft has not published reverse-engineering details; refer to the Microsoft Security Advisory for vendor-supplied information.
Attack Vector
The attacker delivers a malicious .doc or .docx file through email, web download, collaboration platforms, or shared storage. When the victim opens the file in an affected Word build, the parser triggers the use-after-free and the document payload chains heap grooming with control-flow hijack primitives to run code. No authentication is required on the attacker side, but user interaction is mandatory.
No public exploit or proof-of-concept code is currently available. See the Microsoft Security Advisory for vendor guidance and updates.
Detection Methods for CVE-2025-62558
Indicators of Compromise
- Unexpected child processes spawned by winword.exe, such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
- Word process crashes (WerFault.exe events referencing winword.exe) followed by writes to user-writable persistence locations.
- Office documents arriving from external senders that contain embedded objects, unusual OLE streams, or trigger Protected View bypass attempts.
Detection Strategies
- Hunt for process-lineage anomalies in which winword.exe is the parent of script interpreters or LOLBins.
- Inspect Office telemetry for winword.exe exceptions immediately followed by network connections or file writes under %APPDATA% or %TEMP%.
- Correlate Microsoft Defender ASR (Attack Surface Reduction) audit events with document opens from untrusted zones.
Monitoring Recommendations
- Forward Sysmon process creation, image load, and file create events from endpoints running Office to a central SIEM for behavioral correlation.
- Track SharePoint Server document handler crashes and worker process restarts as potential exploitation signals.
- Monitor email gateways for Word attachments matching threat intelligence on weaponized documents tied to this CVE.
How to Mitigate CVE-2025-62558
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Advisory to all affected Office, Microsoft 365 Apps, Word, and SharePoint Server installations.
- Prioritize patching internet-facing SharePoint Servers and shared workstations that handle external documents.
- Enable Microsoft Defender ASR rules that block Office applications from creating child processes.
Patch Information
Microsoft has released updates as part of the December 2025 security release. Administrators should consult the Microsoft Security Advisory for build numbers and KB identifiers specific to each Office channel and servicing model. Microsoft 365 Apps customers on the Current Channel receive updates automatically; LTSC and SharePoint Server administrators must deploy the corresponding cumulative updates manually.
Workarounds
- Keep Protected View and Office File Block policy enabled to force untrusted documents to open in a sandboxed, read-only mode.
- Block or quarantine inbound .doc and .docx attachments from external senders at the email gateway until patches are deployed.
- Restrict execution of macros and embedded objects in documents originating from the internet using Group Policy.
# Configuration example: enable ASR rule to block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
-AttackSurfaceReductionRules_Actions Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
