Microsoft CVE-2025-47162

This vulnerability is a CWE-122 (Heap-based Buffer Overflow), a classic memory corruption flaw where untrusted input writes beyond allocated heap memory boundaries. In Microsoft Office, the overflow likely occurs during parsing of malformed document files (e.g., .docx, .xlsx, .pptx formats) or embedded objects within Office documents. The heap corruption allows an attacker to overwrite adjacent memory structures and corrupt heap metadata, potentially enabling code execution through heap spray techniques or Return-Oriented Programming (ROP) chains. Microsoft Office processes documents in multiple libraries and parsers (including legacy COM-based handlers and modern OOXML processing), making buffer boundaries in parsing routines a critical attack surface. The local attack vector (AV:L) indicates the attacker must have local access to the system or the ability to plant a malicious Office document that a local user opens.