What is the CVSS score of CVE-2025-47953?

CVE-2025-47953 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2025-47953?

Within 24 hours: Identify all Microsoft Office deployments in your environment and confirm current versions against vendor advisory CVE-2025-47953. Within 7 days: Apply the vendor-released patch to all affected Office installations, prioritizing systems handling classified or sensitive data. Within 30 days: Complete organization-wide patch deployment, validate patch installation through endpoint management tools, and conduct spot-check testing to confirm Office functionality.

Microsoft CVE-2025-47953

Q: Which versions of Microsoft are affected by CVE-2025-47953?

CVE-2025-47953 is a use-after-free vulnerability in Microsoft Office with a CVSS score of 8.4 that enables attackers to execute code without prior authentication, potentially compromising sensitive…. A patch is available.

EUVD-2025-17761 HIGH

Improper Restriction of Names for Files and Other Resources (CWE-641)

2025-06-10 secure@microsoft.com

Denial Of Service Microsoft

8.4

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-641 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V5 - File Handling Improper restriction of file name
Impact	CVSS 8.4. EPSS 0.4%. No patch confirmed.
Exploit ScenarioDerived	An attacker could exploit this vulnerability in Use after free in Microsoft Office to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

A security vulnerability in Use after free in Microsoft Office (CVSS 8.4) that allows an unauthorized attacker. High severity vulnerability requiring prompt remediation.

Earlier versions of this analysis (1)

v1 Mar 14, 2026 - 19:49 CVSS 8.4

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

RemediationAI

Monitor vendor channels for patch availability.

Affected VersionsENISA

Microsoft 365 Apps for Enterprise N/A

Microsoft Office LTSC for Mac 2024 1.0.0 <16.98.25060824

Microsoft 365 Apps for Enterprise 16.0.1 <https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2021 16.0.1 <https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2024 1.0.0 <https://aka.ms/OfficeSecurityReleases

Microsoft Office for Android 16.0.1 <16.0.18925.20000

Microsoft Office 2016 16.0.0 <16.0.5504.1000

Microsoft Office 2019 19.0.0 <https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC for Mac 2021 16.0.1 <16.98.25060824

Affected Packages

euvd microsoft_office_2016 fix: 16.0.5504.1000

euvd microsoft_office_for_android fix: 16.0.18925.20000

euvd microsoft_office_ltsc_for_mac_2021 fix: 16.98.25060824

euvd microsoft_office_ltsc_for_mac_2024 fix: 16.98.25060824

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Vulnerability type not specified by vendor. CVSS 8.4 indicates high severity. Affects Use after free in Microsoft Office.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:40 EUVD-patch-fix

executive summary

Patch available

Apr 16, 2026 - 05:29 EUVD

16.98.25060824,16.0.18925.20000,16.0.5504.1000

CVE Published

Jun 10, 2025 - 17:24 nvd

HIGH 8.4

DescriptionCVE.org

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Executive ViewAI

Why It Matters

CVE-2025-47953 is a use-after-free vulnerability in Microsoft Office with a CVSS score of 8.4 that enables attackers to execute code without prior authentication, potentially compromising sensitive documents and organizational data across all users running affected Office versions. Immediate patching is critical to prevent lateral movement and data exfiltration through the widely-deployed Office suite.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.4%

Top 43% exploitable

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.