CVE-2025-54910: 
vulnerability analysis and mitigation

CVE-2025-54910 is a critical heap-based buffer overflow vulnerability in Microsoft Office that was disclosed on September 9, 2025. The vulnerability affects various versions of Microsoft software including Microsoft 365 Apps, Office 2016, 2019, and LTSC 2021 and 2024. This critical flaw received a CVSSv3 score of 8.4 (NVD, Tenable Blog).

The vulnerability is caused by a heap-based buffer overflow condition in Microsoft Office that could allow an unauthorized attacker to execute code locally. The attack vector requires local execution, though the attacker can be remote. The vulnerability has been assigned a CVSSv3 base score of 8.4 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD, Talos Blog).

If successfully exploited, this vulnerability allows an attacker to execute arbitrary code on the target system with the privileges of the compromised user. The vulnerability can be exploited through Microsoft Outlook's Preview Pane, increasing its potential impact (Tenable Blog).

Microsoft has assessed this vulnerability as "Exploitation Less Likely" according to their Exploitability Index. The attack requires convincing a target to open a specially crafted Office document, though exploitation is also possible through Microsoft Outlook's Preview Pane (Tenable Blog).

Microsoft has released security updates to address this vulnerability for affected versions of Microsoft Office. However, for users of Microsoft Office LTSC for Mac 2021 and 2024, updates are not yet available but will be released soon (Tenable Blog).