This vulnerability (CVE-2025-64677) in Microsoft Office Out-of-Box Experience is caused by improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). Exploitation could allow an attacker to conduct spoofing attacks remotely without user interaction or privileges. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability is officially published and a patch is available from Microsoft.

Successful exploitation could lead to unauthorized spoofing attacks that compromise confidentiality of information processed by the Office Out-of-Box Experience. Integrity impact is low and availability is not affected. No known exploits are reported in the wild at this time.

An official patch is available from Microsoft to remediate this vulnerability. It is recommended to apply the patch promptly to mitigate the risk of exploitation. Since this is not a cloud service, remediation requires updating the affected Office component. No additional vendor advisories indicate alternative mitigations or that no action is required.