What is the CVSS score of CVE-2025-47170?

CVE-2025-47170 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of 365 Apps are affected by CVE-2025-47170?

CVE-2025-47170 is a use-after-free vulnerability in Microsoft Office Word that enables local code execution when users open malicious documents, affecting confidentiality, integrity, and availability…. A patch is available.

How to fix or mitigate CVE-2025-47170?

Within 24 hours: Identify all systems running Microsoft Office Word and confirm current version inventory. Within 7 days: Apply the vendor-released patch to all affected Word installations; prioritize systems handling sensitive documents or belonging to high-value users. Within 30 days: Verify patch deployment across the organization via endpoint management tools and conduct user awareness training on risks of opening unsolicited documents.

365 Apps CVE-2025-47170

EUVD-2025-17729 HIGH

Use After Free (CWE-416)

2025-06-10 secure@microsoft.com

Microsoft Denial Of Service 365 Apps Office Long Term Servicing Channel

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:40 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

16.98.25060824

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17729

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 17:23 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

AnalysisAI

Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary code with high impact (confidentiality, integrity, availability). The vulnerability requires user interaction (e.g., opening a malicious document) but has low attack complexity, making it a significant local code execution threat. Without confirmed KEV status or EPSS data provided, the CVSS 7.8 score indicates high severity, though real-world exploitability depends on whether public exploits or proofs-of-concept have emerged.

Technical ContextAI

This vulnerability is rooted in CWE-416 (Use After Free), a memory safety defect where Microsoft Word's document processing engine references memory that has been freed or deallocated. The defect likely occurs in Word's XML/document object model parsing or rendering subsystem when handling specially crafted Office Open XML (.docx) files. The use-after-free condition could corrupt the heap, overwrite function pointers, or leak sensitive memory, enabling code execution through classic heap exploitation techniques. Affected CPE would be Microsoft Office Word across multiple versions (likely Microsoft Word 2016, 2019, Office 365 perpetual/subscription variants), though specific version ranges are not provided in the source data.