CVE-2025-53736: Microsoft Word Information Disclosure Vulnerability

CVE-2025-53736 PUBLISHED CVSS 6.8 MEDIUM

Microsoft Word Information Disclosure Vulnerability

Reported by microsoft · Published August 12, 2025

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
Microsoft Word 2016	Microsoft	16.0.5513.1000
Microsoft Office LTSC for Mac 2024	Microsoft	16.100.25081015

CVSS 3.1

6.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C

Vendor	Product	Versions
Microsoft	Microsoft 365 Apps for Enterprise	16.0.1
Microsoft	Microsoft Office 2019	19.0.0
Microsoft	Microsoft Office LTSC 2021	16.0.1
Microsoft	Microsoft Office LTSC 2024	16.0.0
Microsoft	Microsoft Office LTSC for Mac 2021	16.0.1
Microsoft	Microsoft Office LTSC for Mac 2024	16.0.0
Microsoft	Microsoft SharePoint Enterprise Server 2016	16.0.0
Microsoft	Microsoft SharePoint Server 2019	16.0.0
Microsoft	Microsoft Word 2016	16.0.1
Microsoft	Microsoft Word 2016	16.0.1
Microsoft	Microsoft Office LTSC for Mac 2024	16.0.0
microsoft	office_macos_2024	16.0.0
microsoft	word_2016	16.0.1
microsoft	365_apps	16.0.1
Microsoft	Microsoft Office LTSC 2021	16.0.1
microsoft	sharepoint_server_2016	16.0.0
Microsoft	Microsoft SharePoint Server 2019	16.0.0
Microsoft	Microsoft Office 2019	19.0.0
microsoft	sharepoint_server_2019	16.0.0
Microsoft	Microsoft 365 Apps for Enterprise	16.0.1

…and 7 more

The same record, from the CLI:

vulnetix vdb vuln CVE-2025-53736
vulnetix vdb fixes CVE-2025-53736

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-53736/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart