Critical Flaws in Microsoft Office Enable Remote Code Execution by Attackers

Microsoft has disclosed two serious security vulnerabilities in its Office suite that allow attackers to execute arbitrary code on affected systems, publicly releasing details on 9 September 2025. The flaws, tracked as CVE-2025-54910 and CVE-2025-54906, affect Microsoft Office on Windows and can give an attacker full control over targeted machines.

The first flaw is a heap-based buffer overflow in the Office rendering engine, while the second is a use-after-free in the component that processes embedded objects; both require a user to open a booby-trapped document to be exploited, enabling remote code execution in the context of the current user. CVSS base scores are 8.4 for CVE-2025-54910 and 7.8 for CVE-2025-54906, with temporal scores of 7.3 and 6.8 respectively.

According to Microsoft, these issues can lead to full system compromise, and security updates have been released for supported Windows versions; administrators and users are urged to apply patches promptly and remain vigilant against phishing and untrusted file sources.