Microsoft Word CVE-2025-62555

Apply the Microsoft Office update published in the MSRC update guide for CVE-2025-62555 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62555); the provided input does not include an exact fix version, so the specific patched build numbers must be taken from that advisory, and organizations should update Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024 on all Windows and macOS channels accordingly (patch available per vendor advisory). Until updates are deployed, reduce exposure by ensuring Protected View and Application Guard are enforced for documents originating from the internet or untrusted locations and by using the Microsoft Office Isolated Conversion Environment (MOICE) to convert untrusted Word files in a sandbox - the trade-off is reduced functionality and additional user friction for legitimate documents. Additional compensating controls include blocking or quarantining Word attachments at the email and web gateways, restricting where users can open downloads from, and monitoring endpoint telemetry for Word spawning child processes such as scripting hosts or command shells, which can indicate successful exploitation; these controls lower but do not eliminate risk, since a user can still manually open a local malicious file (as the AV:L/UI:R vector requires). No vendor workaround that fully removes the vulnerability without patching is identified in the available data.