PT-2025-1241 · Microsoft · Office Word+2

D4M0N + 2 · Published 2025-01-14 · Updated 2025-01-17 · CVE-2025-21363

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Word (affected versions not specified) Microsoft Office (affected versions not specified) Microsoft 365 Apps for Enterprise (affected versions not specified)

Description The issue is related to a remote code execution problem in Microsoft Word, associated with the handling of DOCX files and the dereferencing of an uninitialized pointer. This could allow a remote attacker to execute arbitrary code. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For Microsoft Word, update to a version that includes a fix for the uninitialized pointer issue. For Microsoft Office, consider disabling the DOCX file parsing functionality until a patch is available. For Microsoft 365 Apps for Enterprise, restrict access to potentially vulnerable components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Pointer Dereference

Weakness Enumeration

CWE-822

Related Identifiers

BDU:2025-00633

CVE-2025-21363

ZDI-25-030

Affected Products

365 Apps For Enterprise

Office

Office Word

References · 5

• https://bdu.fstec.ru/vul/2025-00633 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-030 · Security Note
• https://osv.dev/vulnerability/CVE-2025-21363 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21363 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21363 · Security Note