EUVD-2025-17730CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary code with high impact on confidentiality, integrity, and availability. The vulnerability requires user interaction (opening a malicious document) but no elevated privileges, making it a significant local code execution threat affecting Word users who open untrusted documents.
Technical ContextAI
The vulnerability exists in Microsoft Office Word's document parsing engine, specifically in heap memory management during the processing of specially crafted Office Open XML (.docx) or legacy binary Word documents (.doc). CWE-122 (Heap-based Buffer Overflow) indicates that the vulnerable code fails to properly validate buffer boundaries when copying data into heap-allocated memory regions, allowing an attacker to write beyond intended buffer limits. This occurs during document deserialization, likely in components handling embedded objects, font processing, or shape rendering. The Local Attack Vector (AV:L) indicates the malicious document must be processed on the target system, and the Requires User Interaction (UI:R) requirement means a victim must open the document in Word for exploitation to occur.
RemediationAI
Immediate actions: (1) Apply Microsoft security patches as released—check Microsoft Update/Windows Update or Microsoft Security Update Guide for KB numbers associated with CVE-2025-47169; (2) If immediate patching is not possible, implement file-level mitigations: disable macros in Word, use Protected View for opening untrusted documents, and configure AppLocker or Device Guard to restrict Word execution to trusted locations; (3) Deploy mail gateway rules to block .doc/.docx attachments from untrusted senders; (4) User education: warn users not to open Word documents from untrusted sources and enable Real-time protection in Windows Defender. Patch versions and KB numbers will be published in Microsoft Security Advisory and MSRC portal—monitor https://msrc.microsoft.com/update-guide for CVE-2025-47169 specifics.
More from same product – last 7 days
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Share
External POC / Exploit Code
Leaving vuln.today