CVE-2025-26629
Published: 11 March 2025
Summary
CVE-2025-26629 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft 365 Apps. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 44.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-26629 is a use-after-free vulnerability (CWE-416) affecting Microsoft Office. Published on 2025-03-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact with local attack vector, low attack complexity, no privileges required, and user interaction needed.
An unauthorized attacker with local access can exploit this flaw by convincing a user to open a malicious Office document or file. Successful exploitation enables arbitrary code execution in the context of the Office process, granting high-impact control over confidentiality, integrity, and availability.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26629 provides guidance on mitigation, including available patches and workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6314
Vulnerability details
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Microsoft Office enables arbitrary code execution via malicious document opened by user, directly mapping to Exploitation for Client Execution (T1203) and User Execution via Malicious File (T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of identified flaws like CVE-2025-26629 through vendor patches for Microsoft Office.
Implements memory protection mechanisms such as ASLR and DEP that directly mitigate use-after-free exploitation in Microsoft Office.
Deploys malicious code protection to scan and block malicious Office documents exploiting the use-after-free vulnerability.