EUVD-2025-17730CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Analysis
Heap-based buffer overflow vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary code with high impact on confidentiality, integrity, and availability. The vulnerability requires user interaction (opening a malicious document) but no elevated privileges, making it a significant local code execution threat affecting Word users who open untrusted documents.
Technical Context
The vulnerability exists in Microsoft Office Word's document parsing engine, specifically in heap memory management during the processing of specially crafted Office Open XML (.docx) or legacy binary Word documents (.doc). CWE-122 (Heap-based Buffer Overflow) indicates that the vulnerable code fails to properly validate buffer boundaries when copying data into heap-allocated memory regions, allowing an attacker to write beyond intended buffer limits. This occurs during document deserialization, likely in components handling embedded objects, font processing, or shape rendering. The Local Attack Vector (AV:L) indicates the malicious document must be processed on the target system, and the Requires User Interaction (UI:R) requirement means a victim must open the document in Word for exploitation to occur.
Affected Products
Microsoft Office Word (specific versions require Microsoft security advisory confirmation; typically recent versions including Microsoft Word 2016, 2019, Office 365/Microsoft 365 with Word component, and Word for Mac are impacted). CPE would typically include: cpe:2.3:a:microsoft:office:*:*:*:*:*:*:*:* and cpe:2.3:a:microsoft:word:*:*:*:*:*:*:*:* with version ranges dependent on patch release. Both 32-bit and 64-bit installations are affected. Legacy Word formats (.doc) and modern OOXML formats (.docx) may both be vulnerable. Users should consult Microsoft Security Update Guide (https://msrc.microsoft.com) for exact affected version ranges and patch availability.
Remediation
Immediate actions: (1) Apply Microsoft security patches as released—check Microsoft Update/Windows Update or Microsoft Security Update Guide for KB numbers associated with CVE-2025-47169; (2) If immediate patching is not possible, implement file-level mitigations: disable macros in Word, use Protected View for opening untrusted documents, and configure AppLocker or Device Guard to restrict Word execution to trusted locations; (3) Deploy mail gateway rules to block .doc/.docx attachments from untrusted senders; (4) User education: warn users not to open Word documents from untrusted sources and enable Real-time protection in Windows Defender. Patch versions and KB numbers will be published in Microsoft Security Advisory and MSRC portal—monitor https://msrc.microsoft.com/update-guide for CVE-2025-47169 specifics.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today