Cyber Posture

CVE-2025-24079

High

Published: 11 March 2025

Published
11 March 2025
Modified
02 July 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0021 43.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24079 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 43.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the use-after-free vulnerability in Microsoft Office Word by requiring timely application of vendor patches to prevent local code execution.

prevent

Implements memory protection mechanisms like ASLR and DEP to block unauthorized code execution from use-after-free exploits in Word.

preventdetect

Deploys malicious code protection tools to scan and block malicious Word documents exploiting the use-after-free vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Use-after-free in Office Word enables arbitrary code execution via malicious document requiring user interaction, directly mapping to client-side exploitation (T1203) and malicious file execution (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Deeper analysisAI

CVE-2025-24079 is a use-after-free vulnerability (CWE-416) in Microsoft Office Word. Published on 2025-03-11, it carries a CVSS v3.1 base score of 7.8 (High), with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The flaw enables an unauthorized attacker to execute code locally on affected systems running vulnerable versions of Microsoft Office Word.

An attacker can exploit this vulnerability with local access to the target system, requiring no privileges (PR:N) but necessitating user interaction (UI:R), such as convincing a user to open a malicious Word document. Successful exploitation leads to arbitrary code execution in the context of the Word process, granting high-impact confidentiality, integrity, and availability consequences (C:H/I:H/A:H) without changing scope.

The Microsoft Security Response Center (MSRC) provides detailed guidance on this vulnerability, including mitigation steps and patches, via its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24079. Security practitioners should consult this resource for affected versions and deployment instructions.

Details

CWE(s)

Affected Products

microsoft
365 apps
all versions
microsoft
office
2019
microsoft
office long term servicing channel
2021, 2024
microsoft
word
2016

CVEs Like This One

CVE-2025-21345Same product: Microsoft 365 Apps
CVE-2025-21392Same product: Microsoft 365 Apps
CVE-2025-21366Same product: Microsoft 365 Apps
CVE-2025-26630Same product: Microsoft 365 Apps
CVE-2026-20952Same product: Microsoft 365 Apps
CVE-2025-62557Same product: Microsoft 365 Apps
CVE-2025-21386Same product: Microsoft 365 Apps
CVE-2025-49695Same product: Microsoft 365 Apps
CVE-2026-20950Same product: Microsoft 365 Apps
CVE-2025-26629Same product: Microsoft 365 Apps

References