CVE-2025-26630
Published: 11 March 2025
Summary
CVE-2025-26630 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 34.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation requires timely patching of the use-after-free vulnerability in Microsoft Office Access as provided in the vendor advisory.
Memory protection mechanisms such as ASLR, DEP, and control flow guard directly mitigate exploitation of use-after-free vulnerabilities by preventing unauthorized code execution.
Malicious code protection scans Office files for threats and can block or detect malicious Access documents requiring user interaction to exploit.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The use-after-free vulnerability in Microsoft Office Access enables arbitrary code execution upon opening a malicious file, directly mapping to T1203 (Exploitation for Client Execution) and T1204.002 (Malicious File under User Execution).
NVD Description
Use after free in Microsoft Office Access allows an unauthorized attacker to execute code locally.
Deeper analysisAI
CVE-2025-26630 is a use-after-free vulnerability (CWE-416) affecting Microsoft Office Access. Published on 2025-03-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw enables an unauthorized attacker to execute code locally on a system running the affected component.
Exploitation requires local access to the target system, low attack complexity, and no privileges from the attacker, though user interaction is necessary, such as opening a malicious file. A successful attack allows arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability.
Microsoft's Security Response Center provides guidance on updates and mitigation in its advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26630.
Details
- CWE(s)