I
mproper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network.
References
| Link | Resource |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64677 | Vendor Advisory |
Configurations
History
16 Jan 2026, 17:28
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:microsoft:office_out-of-box_experience:-:*:*:*:*:*:*:* | |
| References | () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64677 - Vendor Advisory | |
| First Time |
Microsoft office Out-of-box Experience
Microsoft |
19 Dec 2025, 18:00
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-18 22:16
Updated : 2026-01-16 17:28
NVD link : CVE-2025-64677
Mitre link : CVE-2025-64677
CVE.ORG link : CVE-2025-64677
JSON object : View
Products Affected
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')