What is the CVSS score of CVE-2025-47171?

CVE-2025-47171 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.5%.

Which versions of Outlook are affected by CVE-2025-47171?

Organizations using Improper input validation in Microsoft Office Outlook should be aware of notable risk from CVE-2025-47171, a input validation vulnerability rated CVSS 6.7.. A patch is available.

Is there a public PoC exploit available for CVE-2025-47171?

Yes, a public proof-of-concept exploit is available for CVE-2025-47171. Prioritise patching immediately. EPSS: 2.5%.

How to fix or mitigate CVE-2025-47171?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Outlook CVE-2025-47171

EUVD-2025-17728 MEDIUM

Improper Input Validation (CWE-20)

2025-06-10 secure@microsoft.com

Information Disclosure Microsoft Outlook 365 Apps Office Office Long Term Servicing Channel

6.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.7 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

16.0.5504.1000

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17728

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

PoC Detected

Jul 09, 2025 - 13:24 vuln.today

Public exploit code

CVE Published

Jun 10, 2025 - 17:23 nvd

MEDIUM 6.7

DescriptionCVE.org

Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.

Analysis

Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.

Technical ContextAI

This vulnerability is classified as Improper Input Validation (CWE-20).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Outlook

View all

CVE-2013-3870 CRITICAL Emergency POC

9.3 Sep 11

Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrar

CVE-2017-8506 HIGH Act Now

7.8 Jun 15

A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in m

CVE-2024-42220 CRITICAL Act Now POC

9.1 Dec 18

A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. Rated critical severity (CVSS 9.1), thi

CVE-2023-33131 HIGH This Week POC

8.8 Jun 14

Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex

CVE-2016-3278 HIGH Act Now

7.8 Jul 13

Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a craf

CVE-2017-8507 HIGH Act Now

7.8 Jun 15

A remote code execution vulnerability exists in the way Microsoft Office software parses specially crafted email message

CVE-2024-30103 HIGH Act Now

8.8 Jun 11

Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex

CVE-2020-37188 HIGH This Week POC

7.5 Feb 11

SpotOutlook 1.2.6 contains a denial of service vulnerability in the registration name input field that allows attackers

CVE-2017-8663 HIGH Act Now

7.8 Aug 01

Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Mic

CVE-2017-11776 HIGH Act Now

7.5 Oct 13

Microsoft Outlook 2016 allows an attacker to obtain the email content of a user, due to how Outlook 2016 discloses user

CVE-2024-21378 HIGH Act Now

8.8 Feb 13

Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex

CVE-2017-8571 HIGH Act Now

7.8 Aug 01

Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Mic

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2025-47171 vulnerability details – vuln.today

Back

Outlook CVE-2025-47171

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Outlook

Same weakness CWE-20 – Improper Input Validation

Same technique Information Disclosure

Share

External POC / Exploit Code