CVE-2025-21365

Name of the Vulnerable Software and Affected Versions Microsoft Office versions prior to the fixed version Microsoft 365 Apps for Enterprise versions prior to the fixed version

Description The issue is related to the use of an unreliable path search in Microsoft Office and Microsoft 365 Apps for Enterprise. This allows an attacker to execute arbitrary code. The vulnerability affects Word, PowerPoint, and Outlook. It is described as a logic bug that includes built-in process control and built-in PV bypass.

Recommendations For Microsoft Office versions prior to the fixed version, update to the fixed version to resolve the issue. For Microsoft 365 Apps for Enterprise versions prior to the fixed version, update to the fixed version to resolve the issue. As a temporary workaround, consider restricting the use of built-in processes and PV until a patch is available.