CVE-2025-47953
Published: 10 June 2025
Summary
CVE-2025-47953 is a high-severity Improper Restriction of Names for Files and Other Resources (CWE-641) vulnerability in Microsoft Office. Its CVSS base score is 8.4 (High).
Operationally, ranked in the top 21.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-47953 is a use-after-free vulnerability in Microsoft Office that carries a CVSS 3.1 score of 8.4. The flaw is tracked under CWE-641 and permits an attacker to execute arbitrary code on an affected system.
An unauthenticated local attacker can trigger the condition without user interaction or elevated privileges, resulting in full compromise of confidentiality, integrity, and availability on the target host.
The sole reference points to the Microsoft Security Response Center advisory for CVE-2025-47953, which is the authoritative source for patch availability and mitigation guidance. The associated EPSS score has remained low, with a current value of 0.0108 and a peak of 0.0146.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-17761
Vulnerability details
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.