EUVD-2025-17732
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
Analysis
Type confusion vulnerability in Microsoft Office that allows unauthenticated local attackers to execute arbitrary code with high impact on confidentiality, integrity, and availability. The vulnerability exploits improper resource access due to incompatible type handling, requiring no user interaction or privileges. This is a critical local code execution vector affecting Microsoft Office installations.
Technical Context
The vulnerability stems from CWE-843 (Access of Resource Using Incompatible Type), a memory safety issue where type confusion occurs during resource access operations. In the context of Microsoft Office, this likely involves improper type checking in Office document processing libraries or COM object handling, where the application fails to validate that a resource is of the expected type before accessing it. This can lead to out-of-bounds memory access, use-after-free conditions, or unintended memory corruption. Type confusion vulnerabilities in Office typically manifest in parsing engines, OLE/COM marshaling layers, or Office Open XML (OOXML) processing components. The local attack vector (AV:L) indicates the attacker must have local system access, distinguishing this from remote Office exploits.
Affected Products
Microsoft Office (specific versions and editions not provided in the given data). Based on the CVE description and CWE classification, affected products likely include: Microsoft Word, Microsoft Excel, Microsoft PowerPoint, and Microsoft Office 365 applications. The type confusion vulnerability in document processing suggests impact on all Office editions that process legacy OLE compound documents or OOXML formats. Specific version ranges and CPE strings cannot be definitively stated without access to Microsoft Security Advisories or the official CVE entry with CPE data. Typical CPE patterns for Office would be: cpe:2.3:a:microsoft:office:*:*:*:*:*:windows:*:* and derivative products. Recommended action: consult Microsoft Security Update Guide (aka.ms/SecurityUpdateGuide) and official Microsoft advisories for CVE-2025-47167 for precise version numbers and affected SKUs.
Remediation
Immediate remediation steps: (1) Identify all systems running Microsoft Office and document versions/editions currently deployed. (2) Monitor Microsoft Security Response Center (MSRC) for an official patch release targeting CVE-2025-47167. (3) Once patches are available, prioritize deployment to systems where local access is highest-risk (shared terminals, developer machines, high-user-count systems). (4) Interim mitigations while awaiting patches: restrict local user account creation and login capabilities, implement application whitelisting to prevent unauthorized Office document processing, disable legacy document format support (OLE) if feasible, and enforce endpoint detection and response (EDR) monitoring for suspicious Office process behavior. (5) For Office 365 environments, patches are typically deployed automatically; verify patch status through Microsoft 365 admin portal. (6) Apply patches in sequence: Security Updates > Monthly Quality Updates. (7) Test patches in non-production environments before broad deployment to ensure compatibility with line-of-business applications and Office macros/add-ins. Contact Microsoft Support (support.microsoft.com) or your Microsoft account representative for CVE-2025-47167-specific guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today