Remote Code Execution in Microsoft Office Use-After-Free

CVE-2025-49695 is a Critical use-after-free vulnerability in Microsoft Office. Microsoft describes the issue as a condition where Office accesses memory after it has already been freed, which can result in attacker-controlled code execution. The vulnerability is classified by Microsoft as a Remote Code Execution issue, although the vendor notes that the attack is carried out locally on the target machine and that 'remote' refers to the attacker’s location rather than a network-reachable service. Available reporting indicates the Preview Pane is an attack vector, and exploitation may occur without the user explicitly opening the malicious document. The flaw affects Microsoft Office on Windows and also affected Microsoft Office LTSC for Mac 2021 and 2024, for which updates were later released.