CVE-2025-30377: 
vulnerability analysis and mitigation

CVE-2025-30377 is a Remote Code Execution (RCE) vulnerability discovered in Microsoft Office. The vulnerability was disclosed on May 13, 2025, as part of Microsoft's May 2025 Patch Tuesday security updates. It is classified as a use-after-free vulnerability that allows an unauthorized attacker to execute code locally on affected systems (NVD, Talos).

The vulnerability has been assigned a CVSS 3.1 base score of 8.4 (HIGH) with attack complexity rated as "Low". The CVSS vector string is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is categorized under CWE-416 (Use After Free) and affects various versions of Microsoft Office, including Office 2016, Office 2019, Microsoft 365 Apps, and Office Long Term Servicing Channel (NVD).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system with the privileges of the compromised user. The vulnerability has been rated as Critical due to its potential impact on system security (Wiz).

Microsoft has released security updates to address this vulnerability as part of the May 2025 Patch Tuesday. Users and administrators are strongly advised to apply these updates immediately through Windows Update or enterprise management tools (Wiz).