CVE-2025-54906

Published Sep 9, 2025

Last updated 6 days ago

Microsoft Office

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-54906 is a remote code execution (RCE) vulnerability in Microsoft Office that stems from freeing memory not on the heap. This vulnerability can be triggered by maliciously crafted Office files, which could allow an attacker to execute arbitrary code on a system. Successful exploitation of CVE-2025-54906 could allow an attacker to execute malicious code within the context of the current user. An attacker would need prior access to the target system or convince a user to open a specially crafted file to achieve local code execution. Microsoft has released patches to address this vulnerability.

Description: Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally.
Source: secure@microsoft.com
NVD status: Analyzed
Products: 365_apps, office, office_long_term_servicing_channel, sharepoint_server

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-416
nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "72324216-4EB3-4243-A007-FEF3133C7DF9"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "0FBB0E61-7997-4F26-9C07-54912D3F1C10"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "CF5DDD09-902E-4881-98D0-CB896333B4AA"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "26A3B226-5D7C-4556-9350-5222DC8EFC2C"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EF3E56B5-E6A6-4061-9380-D421E52B9199"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F815EF1D-7B60-47BE-9AC2-2548F99F10E4"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6122D014-5BF1-4AF4-8B4D-80205ED7785E"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.