CVE-2026-25925: PowerDocu RCE Vulnerability

CVE-2026-25925 Overview

CVE-2026-25925 is an insecure deserialization vulnerability affecting PowerDocu, a Windows GUI application used for generating technical documentation from Microsoft Power Platform components. Prior to version 2.4.0, the application contains a critical security flaw in how it parses JSON files within Flow or App packages. The application blindly trusts the $type property in JSON files, allowing an attacker to instantiate arbitrary .NET objects and execute code on the target system.

Critical Impact

This vulnerability enables arbitrary code execution through maliciously crafted JSON files. An attacker can leverage the insecure deserialization to instantiate dangerous .NET objects, potentially leading to complete system compromise when a user opens a specially crafted Flow or App package.

Affected Products

• PowerDocu versions prior to 2.4.0
• Windows systems running vulnerable PowerDocu installations
• Environments processing untrusted Flow or App packages

Discovery Timeline

• 2026-02-09 - CVE-2026-25925 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-25925

Vulnerability Analysis

This vulnerability falls under CWE-502 (Deserialization of Untrusted Data). The core issue lies in how PowerDocu handles JSON deserialization when processing Flow or App packages. The application uses a .NET JSON deserializer configured to process type information embedded within the JSON payload itself via the $type property.

When a user opens a malicious package file, the deserializer reads the $type property and uses it to determine which .NET class to instantiate. Without proper validation or type restrictions, an attacker can specify arbitrary .NET types, including those with dangerous side effects during construction or property assignment. This is a well-known attack pattern against .NET applications using insecure JSON deserialization settings.

The local attack vector requires user interaction—specifically, the victim must open a malicious Flow or App package. This could be achieved through social engineering, such as sending a seemingly legitimate documentation package via email or hosting it on a compromised download site.

Root Cause

The root cause is the use of a permissive JSON deserialization configuration that honors the $type discriminator property without implementing a type allowlist. In .NET JSON serializers like Newtonsoft.Json (Json.NET), enabling TypeNameHandling without proper SerializationBinder restrictions allows arbitrary type instantiation. The application failed to restrict which types could be deserialized, trusting user-controlled input to specify object types.

Attack Vector

The attack requires local access and user interaction. An attacker crafts a malicious Flow or App package containing JSON files with specially crafted $type properties pointing to dangerous .NET gadget classes. When PowerDocu processes this package, the deserializer instantiates the specified objects, triggering code execution.

Common .NET deserialization gadget chains that could be leveraged include System.Windows.Data.ObjectDataProvider, System.Configuration.Install.AssemblyInstaller, and various other classes that execute code during instantiation or property assignment. The attacker can chain these gadgets to achieve arbitrary command execution.

For detailed technical information about this vulnerability, see the GitHub Security Advisory GHSA-m8j2-5jr7-2jpw.

Detection Methods for CVE-2026-25925

Indicators of Compromise

• Presence of PowerDocu versions prior to 2.4.0 on Windows systems
• Suspicious JSON files containing $type properties with unexpected .NET type references
• Unexpected child processes spawned by the PowerDocu executable
• Unusual system activity following the opening of Flow or App package files

Detection Strategies

• Monitor for PowerDocu process spawning unexpected child processes, particularly cmd.exe, powershell.exe, or other command interpreters
• Implement file integrity monitoring on systems where PowerDocu is installed to detect unauthorized modifications
• Deploy endpoint detection solutions capable of identifying .NET deserialization attack patterns
• Scan inbound Flow and App packages for suspicious JSON structures containing unusual $type references

Monitoring Recommendations

• Enable detailed logging for PowerDocu application activity
• Configure SentinelOne agents to monitor for behavioral indicators associated with deserialization attacks
• Implement network monitoring to detect data exfiltration attempts following potential exploitation
• Review email attachments and downloaded files for suspicious package formats targeting PowerDocu users

How to Mitigate CVE-2026-25925

Immediate Actions Required

• Upgrade PowerDocu to version 2.4.0 or later immediately
• Audit systems for installations of vulnerable PowerDocu versions
• Educate users about the risks of opening untrusted Flow or App packages
• Consider temporarily restricting PowerDocu usage until patching is complete

Patch Information

The vulnerability has been addressed in PowerDocu version 2.4.0. The fix implements proper type validation during JSON deserialization, preventing arbitrary object instantiation through the $type property. Organizations should download the patched version from the official PowerDocu Release v2.4.0.

Workarounds

• Avoid processing Flow or App packages from untrusted sources until the patch is applied
• Implement application allowlisting to prevent unauthorized code execution
• Run PowerDocu in an isolated environment or sandbox when processing packages from external sources
• Deploy endpoint protection with behavioral analysis capabilities to detect exploitation attempts