CVE-2025-21363

# Summary

OS: window 10/11

TARGET: msoffice winword.exe

TYPE: Microsoft Word Remote Code Execution Vulnerability

 

 

# Description

• This vulnerability was discovered during the process of parsing the .docx file structure in the WINWORD.EXE program.
• By exploiting this vulnerability, attacker can control the IP register by referencing an arbitrary heap chunk.

 

 

# Analysis

1. A function allocates and frees a small heap chunk.
2. B function allocates a small heap chunk .
3. The heap memory used by A function is then reused by B function.
4. At this time, the previously used allocated memory is not initialized.
5. As a result, an arbitrary address can be called inside A function.

windbg debugging

 

 

# Exploitablility

• I consider that this vulnerability could be utilized as part of an attack scenario.
• For research purposes, I disabled the DEP protection to demonstrate the feasibility of using an exploit chain gadget and prove its malicious potential.
• Additionally, an extra scenario is needed for a complete ASLR bypass.
• (In this video, ASLR mitigation was circumvented probabilistically)
• Below is the PoC demo recorded on 2024-04-21(@Jmini)

 

 

# Reference

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21363  
• https://shell-storm.org/shellcode/index.html  
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1642