Microsoft continues to patch bugs found through my Office fuzzing project. Today they have patched:
- Microsoft Word Remote Code Execution Vulnerability (CVE-2025-59221)
msrc.microsoft.com/update-gu…
- Microsoft Word Remote Code Execution Vulnerability (CVE-2025-59222)
msrc.microsoft.com/update-gu…
These two bugs are in a new attack vector specific to Microsoft Word. It took me a really significant amount of time and energy to help MSRC reproduce the issues (see the timeline for CVE-2025-59221/97766
linkedin.com/posts/haifeili_…). Despite all the HUGE effort, MSRC rated the quality as "low" (which I still personally disagree with:P).
Let me take a break and review for my year-long journey in Office bug hunting since I started this project (which I wanted to do for a long time) last October. I’m happy to report that I’ve reported approximately 28 Office bugs during this journey. Most of them have been patched and were in Microsoft Word (see the list below), few were duplicated or non-exploitable though, and there are still 7 or 8 bugs waiting to be confirmed and patched by Microsoft.
October 2025:
- Word RCE, CVE-2025-59221
- Word RCE, CVE-2025-59222
August 2025:
- Word RCE, CVE-2025-53738
- Word RCE, CVE-2025-53784
July 2025:
- Word RCE, CVE-2025-49699
- Word RCE, CVE-2025-49700
June 2025:
- Word RCE/heap-overflow, CVE-2025-32717
- Word RCE, CVE-2025-47170
- Word RCE, CVE-2025-47957
May 2025:
- Outlook RCE, CVE-2025-32705
- PowerPoint RCE, CVE-2025-29978
April 2025:
- Word RCE, CVE-2025-29820
March 2025:
- Word RCE, CVE-2025-26629
- Word RCE, CVE-2025-24077
- Word RCE, CVE-2025-24078
- Word RCE, CVE-2025-24079
- Word RCE, CVE-2025-24080
February 2025:
- Word RCE, CVE-2025-21392
- Word RCE, CVE-2025-21397
For me, this proves that my systematic, code-coverage-based bug hunting methodology is effective and powerful. By maximizing code coverage in the target application, even with mature software like Microsoft Office, you can still find a lot of bugs.
For Microsoft and the general public (Office users), I believe together we've made Office much safer by patching various bugs across different attack vectors. Thank you to all the Microsoft folks who have worked with me.
I will probably continue this journey, as I know I’ve only scratched the surface of this vast challenge. My fuzzing system still generates new code coverage (samples) every day, and there are many "adjustments" to the fuzzer to target different attack vectors and during the bug analyzing process, I continued to learn about new attack vectors. There's still a lot of work to do if I receive support. But for now, let me take some vacations first. :)
#PatchTuesday #VulnerabilityResearch #OfficeSecurity #fuzzing #codecoverage