SB2025040874 - Multiple vulnerabilities in Microsoft Office

Description

This security bulletin contains information about 7 vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2025-27748)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Microsoft Office. A remote attacker can trick a victim to download and open a specially crafted file and execute arbitrary code on the target system.

2) Use-after-free (CVE-ID: CVE-2025-29792)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Microsoft Office. A remote user can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

3) Use-after-free (CVE-ID: CVE-2025-27749)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Microsoft Office. A remote attacker can trick a victim to download and open a specially crafted file and execute arbitrary code on the target system.

4) Use-after-free (CVE-ID: CVE-2025-27746)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Microsoft Office. A remote attacker can trick a victim to download and open a specially crafted file and execute arbitrary code on the target system.

5) Improper access control (CVE-ID: CVE-2025-27744)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in Microsoft Office. A local user can bypass implemented security restrictions and gain elevated privileges on the system.

6) Use-after-free (CVE-ID: CVE-2025-27745)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Microsoft Office. A remote attacker can trick a victim to download and open a specially crafted file and execute arbitrary code on the target system.

7) Integer overflow (CVE-ID: CVE-2025-26642)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in Microsoft Office. A remote attacker can trick a victim to download and open a specially crafted file, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-27748
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-29792
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-27749
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-27746
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-27744
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-27745
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-26642