Office CVE-2025-47165

This vulnerability presents moderate-to-high real-world risk despite the high CVSS score. Risk signals: (1) CVSS 7.8/10 with AV:L (local only) and AC:L (low complexity) indicates the vulnerability requires user interaction but is straightforward to exploit once access is gained; (2) UI:R (requires user interaction—opening a file) limits automated worm propagation but remains practical via email attachment or file-sharing attacks; (3) No KEV confirmation or active exploitation reports in provided data reduce immediate threat, but absence of data does not mean absence of real-world exploitation; (4) EPSS data not provided, but the local+interactive nature suggests lower network-wide exploitation probability compared to remote vulnerabilities; (5) The high impact (C:H/I:H/A:H) confirms complete compromise once triggered. Priority assessment: HIGH for organizations with Office deployments and external file ingestion; MEDIUM for air-gapped or restricted environments. This is NOT a low-priority high-CVSS issue—the execution impact is genuine.

An attacker sends a victim a crafted Excel file (.xlsx, .xls, or macro-enabled variant) via email or file-sharing platform. The file contains maliciously formatted cell data, formulas, or embedded objects engineered to trigger a use-after-free condition in Excel's rendering engine. When the user opens the file in Excel (satisfying UI:R requirement), the vulnerable code dereferences freed memory, allowing the attacker to overwrite heap structures and execute shellcode. The payload executes with the user's privilege level (typically standard user on modern Windows, but potentially admin if the user has elevated privileges). Attacker gains local code execution, can steal data, install malware, or pivot to network resources. No public POC confirmed in provided dataset, but the straightforward nature of use-after-free exploitation in Office products suggests community POC development is probable post-disclosure. Attack complexity is low (AC:L), making it practical for targeted attacks or mass campaigns.