CVE-2025-24080
Published: 11 March 2025
Summary
CVE-2025-24080 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 43.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the use-after-free vulnerability in Microsoft Office by requiring identification, reporting, and patching of the specific flaw.
Implements system memory protections designed to minimize the impact of memory-related flaws like use-after-free errors exploited via malicious Office documents.
Deploys malicious code protection to scan and block malicious Office documents that attempt to exploit the use-after-free vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free vulnerability in Microsoft Office enabling arbitrary code execution via malicious document directly maps to Exploitation for Client Execution (T1203).
NVD Description
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Deeper analysisAI
CVE-2025-24080 is a use-after-free vulnerability (CWE-416) affecting Microsoft Office. Published on March 11, 2025, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw enables an unauthorized attacker to execute arbitrary code locally on a victim's machine.
Exploitation requires local access to the target system and low-complexity conditions, with no privileges needed from the attacker but user interaction required, such as opening a malicious document. Successful exploitation grants high-impact confidentiality, integrity, and availability effects, potentially allowing full code execution in the context of the affected Office process.
For mitigation details, refer to the official advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24080.
Details
- CWE(s)