CVE-2025-32717
Published: 11 June 2025
Summary
CVE-2025-32717 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft 365 Apps. Its CVSS base score is 8.4 (High).
Operationally, ranked in the top 23.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2025-32717 is a heap-based buffer overflow tracked under CWE-122 that affects Microsoft Office Word. It received a CVSS 3.1 base score of 8.4 reflecting local attack vector, low attack complexity, and no requirements for privileges or user interaction, with high impact on confidentiality, integrity, and availability.
An unauthorized attacker with local access can exploit the flaw to execute arbitrary code on the target system. The published EPSS values remain low, with a current score of 0.0089 and a peak of 0.0121.
Mitigation guidance is available in the Microsoft Security Response Center advisory referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32717.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-18063
Vulnerability details
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.