What is the CVSS score of CVE-2025-47167?

CVE-2025-47167 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Microsoft are affected by CVE-2025-47167?

CVE-2025-47167 is a high-severity type confusion vulnerability in Microsoft Office that enables unauthenticated local attackers to execute arbitrary code without user interaction, creating a direct…. A patch is available.

How to fix or mitigate CVE-2025-47167?

Within 24 hours: Identify all Microsoft Office installations in your environment and confirm current versions against Microsoft's advisory for CVE-2025-47167. Within 7 days: Apply vendor-released patch to all affected Office installations; prioritize systems handling sensitive data and administrative functions. Within 30 days: Verify patch deployment across 100% of endpoints through vulnerability scanning; document exceptions with risk acceptance from leadership.

Microsoft CVE-2025-47167

EUVD-2025-17732 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2025-06-10 secure@microsoft.com

Microsoft Authentication Bypass Memory Corruption

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:40 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

16.98.25060824,16.0.18925.20000,16.0.5504.1000

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17732

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 17:23 nvd

HIGH 8.4

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Type confusion vulnerability in Microsoft Office that allows unauthenticated local attackers to execute arbitrary code with high impact on confidentiality, integrity, and availability. The vulnerability exploits improper resource access due to incompatible type handling, requiring no user interaction or privileges. This is a critical local code execution vector affecting Microsoft Office installations.

Technical ContextAI

The vulnerability stems from CWE-843 (Access of Resource Using Incompatible Type), a memory safety issue where type confusion occurs during resource access operations. In the context of Microsoft Office, this likely involves improper type checking in Office document processing libraries or COM object handling, where the application fails to validate that a resource is of the expected type before accessing it. This can lead to out-of-bounds memory access, use-after-free conditions, or unintended memory corruption. Type confusion vulnerabilities in Office typically manifest in parsing engines, OLE/COM marshaling layers, or Office Open XML (OOXML) processing components. The local attack vector (AV:L) indicates the attacker must have local system access, distinguishing this from remote Office exploits.

RemediationAI

Immediate remediation steps: (1) Identify all systems running Microsoft Office and document versions/editions currently deployed. (2) Monitor Microsoft Security Response Center (MSRC) for an official patch release targeting CVE-2025-47167. (3) Once patches are available, prioritize deployment to systems where local access is highest-risk (shared terminals, developer machines, high-user-count systems). (4) Interim mitigations while awaiting patches: restrict local user account creation and login capabilities, implement application whitelisting to prevent unauthorized Office document processing, disable legacy document format support (OLE) if feasible, and enforce endpoint detection and response (EDR) monitoring for suspicious Office process behavior. (5) For Office 365 environments, patches are typically deployed automatically; verify patch status through Microsoft 365 admin portal. (6) Apply patches in sequence: Security Updates > Monthly Quality Updates. (7) Test patches in non-production environments before broad deployment to ensure compatibility with line-of-business applications and Office macros/add-ins. Contact Microsoft Support (support.microsoft.com) or your Microsoft account representative for CVE-2025-47167-specific guidance.