CVE-2025-47162
Published: 10 June 2025
Summary
CVE-2025-47162 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 8.4 (High).
Operationally, ranked in the top 23.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2025-47162 is a heap-based buffer overflow tracked under CWE-122 that affects Microsoft Office. It received a CVSS 3.1 base score of 8.4 reflecting local attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
An unauthorized attacker with local access can exploit the flaw to execute arbitrary code on the target system. The attack requires no authentication or user interaction, enabling direct achievement of full code execution privileges within the context of the affected Office process.
Microsoft has published an advisory for CVE-2025-47162 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47162 that addresses mitigation steps and available updates. The associated EPSS score remains low, with a current value of 0.0089 and a peak of 0.0121.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-17768
Vulnerability details
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.