PT-2025-28600 · Microsoft · Office Word+1

Published 2025-07-08 · Updated 2025-09-03 · CVE-2025-49703

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office Microsoft Word Microsoft 365 Apps for Enterprise Microsoft Office Long Term Servicing Channel Microsoft SharePoint Server versions prior to the July 15, 2025 update

Description A use-after-free issue exists in Microsoft Office Word. This allows an unauthorized attacker to execute code locally. The vulnerability also allows remote attackers to execute arbitrary code and affect the system.

Recommendations Install the security update for Microsoft Office LTSC for Mac 2021 and 2024, available as of July 15, 2025. Ensure all other affected Microsoft products are updated to a version released on or after July 15, 2025.

Fix

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-08435

CVE-2025-49703

Affected Products

Office Word

Sharepoint Server

References · 14

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49703 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49703 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49703 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49703 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/722794 · Security Note
• https://bdu.fstec.ru/vul/2025-08435 · Security Note
• https://t.me/msrcreports/2070 · Telegram Post
• https://t.me/four_rays/117 · Telegram Post
• https://twitter.com/RedaAnoar/status/1951703317417230791 · Twitter Post
• https://twitter.com/CVEnew/status/1942633693534695830 · Twitter Post
• https://twitter.com/RedaAnoar/status/1952786606017900798 · Twitter Post
• https://t.me/cvenotify/129206 · Telegram Post
• https://twitter.com/RedaAnoar/status/1951701013486059789 · Twitter Post
• https://t.me/aptreports/20617 · Telegram Post