A heap-based buffer overflow vulnerability in Microsoft Office products permits unauthorized local code execution, posing a significant risk to system integrity.

This is a heap-based buffer overflow (CWE-122) occurring within Microsoft Office, which allows an unauthorized local attacker to trigger memory corruption and achieve arbitrary code execution.

Successful exploitation of this vulnerability allows an attacker to execute code with the permissions of the local user, potentially leading to a complete compromise of the affected workstation. With a CVSS score of 8.4, this vulnerability is classified as High severity, indicating that it could facilitate significant data exfiltration, lateral movement within the network, or persistent system access.

Immediate Action: Apply the relevant security updates provided by Microsoft via the official update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49697 immediately.

Proactive Monitoring: Monitor endpoint detection and response logs for suspicious process execution patterns or unexpected crashes associated with Office applications.

Compensating Controls: Ensure that users operate with the principle of least privilege to limit the impact of potential code execution, and utilize endpoint protection software to detect malicious file execution.

Public Exploit Available: No (exploit_available: false)

Given the potential for arbitrary code execution, organizations must prioritize the deployment of Microsoft security patches across all affected Office versions. Administrators should verify that automatic updates are enabled or push the relevant patches through centralized management tools to ensure comprehensive coverage and mitigate the risk of local exploitation.