Loading vulnerability…
Microsoft Office Heap-Based Buffer Overflow Remote Code Execution
CVE-2025-24057 is a heap-based buffer overflow in Microsoft Office that can allow code execution. Exploitation involves a specially crafted file; reporting indicates it can be triggered when a user downloads and opens such a file and may also be reachable through the Office Preview Pane.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthorized attacker to execute code on the affected system. The broader Microsoft Office advisory characterizes the potential outcome as remote arbitrary code execution.
If you can’t patch tonight, do this now.
Apply the newly released Microsoft Office security updates. Until patching is complete, avoid opening or previewing untrusted Office files, particularly files received through unsolicited or untrusted channels.
Patch, then assume compromise.
Install the Microsoft security updates for affected Microsoft Office products, including the applicable Office, Microsoft 365 Apps, Office LTSC, Office 2019, Office 2016, Office for Mac, and Office Online Server updates identified in Microsoft’s security guide.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.