8.2 High

CVE-2025-64677 Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience…

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network.

Affected products and versions

Product	Affected versions	Fixed in
Office Out-of-Box Experience	Versions not published

Do you use Office Out-of-Box Experience?

Track this CVE Watch Office Out-of-Box Experience Check my SBOMs

www.cveye.io/en/cve/CVE-2025-64677

Timeline

Published December 18, 2025
Last modified April 16, 2026

References

Office Out-of-Box Experience Spoofing Vulnerability msrc.microsoft.com

Track this CVE