What is the CVSS score of CVE-2025-49698?

CVE-2025-49698 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Word are affected by CVE-2025-49698?

CVE-2025-49698 is a use-after-free vulnerability in Microsoft Office Word that allows local code execution without requiring user authentication, affecting organizations with Word deployments across…. A patch is available.

How to fix or mitigate CVE-2025-49698?

Within 24 hours: Identify all systems running Microsoft Office Word and assess local access controls. Within 7 days: Apply the vendor-released patch to all affected Word installations and verify successful deployment across the organization. Within 30 days: Conduct post-patch validation, monitor for exploitation attempts in security logs, and document remediation completion.

Word CVE-2025-49698

EUVD-2025-20560 HIGH

Use After Free (CWE-416)

2025-07-08 secure@microsoft.com

Microsoft Use After Free Memory Corruption Denial Of Service Word 365 Apps Office Office Long Term Servicing Channel

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:30 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

16.0.5508.1001,16.99.25071321

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20560

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

CVE Published

Jul 08, 2025 - 17:15 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Analysis

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Technical ContextAI

A use-after-free vulnerability occurs when a program continues to use a pointer after the referenced memory has been freed, leading to undefined behavior. This vulnerability is classified as Use After Free (CWE-416).