Office CVE-2025-47175

The risk profile presents mixed signals: CVSS 7.8 with CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates high impact (confidentiality, integrity, availability all compromised) with low attack complexity and no privilege requirement, but requires user interaction. The local attack vector (AV:L) limits exposure compared to network-exploitable flaws. Real-world risk is elevated because: (1) PowerPoint is ubiquitous in enterprise environments, (2) social engineering can reliably trigger user interaction, (3) use-after-free vulnerabilities are often reliably exploitable in practice, (4) the lack of privilege requirement means any user can be compromised. However, without confirmation of active KEV listing or public POC availability, this may be in early disclosure phase. Organizations with high-value targets using PowerPoint, financial services, government, and defense sectors should prioritize patching. General enterprise users should treat this as urgent but not critical-infrastructure-level emergency.

An attacker crafts a malicious PowerPoint presentation (.pptx file) containing specially formatted content that triggers the use-after-free condition in the file parser. The file is distributed via phishing email or compromised website. A target user downloads and opens the file in PowerPoint (fulfilling the UI:R requirement). Upon parsing the malicious content structure, the vulnerability causes PowerPoint to reference freed memory, allowing the attacker's payload to execute in the context of the user's process. Result: arbitrary code execution with the user's privileges, potentially leading to credential theft, lateral movement, or data exfiltration. No privileges are required from the victim—a standard user account is sufficient. If POC exists in the wild, exploitation likelihood increases significantly; current status unknown without KEV/EPSS data access.