EUVD-2025-17730Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary code with high impact on confidentiality, integrity, and availability. The vulnerability requires user interaction (opening a malicious document) but no elevated privileges, making it a significant local code execution threat affecting Word users who open untrusted documents.
Technical ContextAI
The vulnerability exists in Microsoft Office Word's document parsing engine, specifically in heap memory management during the processing of specially crafted Office Open XML (.docx) or legacy binary Word documents (.doc). CWE-122 (Heap-based Buffer Overflow) indicates that the vulnerable code fails to properly validate buffer boundaries when copying data into heap-allocated memory regions, allowing an attacker to write beyond intended buffer limits. This occurs during document deserialization, likely in components handling embedded objects, font processing, or shape rendering. The Local Attack Vector (AV:L) indicates the malicious document must be processed on the target system, and the Requires User Interaction (UI:R) requirement means a victim must open the document in Word for exploitation to occur.
RemediationAI
Immediate actions: (1) Apply Microsoft security patches as released—check Microsoft Update/Windows Update or Microsoft Security Update Guide for KB numbers associated with CVE-2025-47169; (2) If immediate patching is not possible, implement file-level mitigations: disable macros in Word, use Protected View for opening untrusted documents, and configure AppLocker or Device Guard to restrict Word execution to trusted locations; (3) Deploy mail gateway rules to block .doc/.docx attachments from untrusted senders; (4) User education: warn users not to open Word documents from untrusted sources and enable Real-time protection in Windows Defender. Patch versions and KB numbers will be published in Microsoft Security Advisory and MSRC portal—monitor https://msrc.microsoft.com/update-guide for CVE-2025-47169 specifics.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today