Windows CVE-2025-47957

CVSS 8.4 with AV:L/AC:L/PR:N/UI:N indicates a HIGH severity local code execution primitive with low attack complexity and no user interaction required—a strong technical signal. However, real-world priority depends on: (1) EPSS score (if >0.95, exploitation is highly probable and should be treated as critical); (2) KEV/CISA known exploited status (currently unconfirmed in provided data); (3) Public POC availability (not confirmed); (4) Affected product scope (Word is ubiquitous, raising blast radius). The local-only attack vector significantly reduces opportunistic remote exploitation risk compared to network-based vulnerabilities, but for compromised systems, local privilege escalation or sandbox escape becomes a primary threat. SSVC analysis suggests: Exploitation=Unspecified (needs confirmation), Automatable=Yes (memory corruption often requires fuzzing but can be automated), Technical Impact=Total (arbitrary code execution). Recommendation: Treat as high-priority but not critical-without-context; prioritize patching on multi-user systems, shared workstations, and environments where local code execution is a plausible threat model.

An attacker with local system access (e.g., via prior compromise, USB access, or insider threat) crafts a malicious Word document (.docx, .doc, or macro-enabled variant) designed to trigger a use-after-free condition during parsing. When a victim opens the document, the vulnerability causes Word to reference freed memory, which the attacker has pre-populated with shellcode. Exploitation does not require user interaction beyond opening the file (UI:N), making social engineering unnecessary if the attacker can write to accessible file locations. The attacker achieves arbitrary code execution in the context of the Word process (typically medium or high integrity, depending on UAC configuration), enabling privilege escalation, data exfiltration, or lateral movement within the system. If POC is publicly available, exploitation difficulty decreases significantly; absence of confirmed POC suggests exploitation requires specialized fuzzing or reverse engineering to reliably trigger the memory condition.