Description
Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Office Out-of-Box Experience | - | — |
Advisories 1
- MSRC-CVE-2025-64677 Office Out-of-Box Experience Spoofing Vulnerability Microsoft Security Response Center · Dec 18, 2025
References
- Office Out-of-Box Experience Spoofing Vulnerability vendor-advisory patch