CVE-2025-24083
Published: 11 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-24083 is an untrusted pointer dereference vulnerability (CWE-822) in Microsoft Office. Published on 2025-03-11, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
An unauthorized attacker with local access can exploit this vulnerability through low-complexity attacks that require user interaction, such as opening a malicious Office document. Successful exploitation enables arbitrary code execution locally, granting high-impact control over confidentiality, integrity, and availability without privilege escalation.
Microsoft's update guide provides details on mitigation, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24083.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability in Microsoft Office is triggered by opening a malicious document and results in arbitrary code execution, directly enabling T1203 (Exploitation for Client Execution) and T1204.002 (Malicious File under User Execution).