CVE-2025-47994
Published: 08 July 2025
Summary
CVE-2025-47994 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Microsoft Office. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked in the top 19.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of flaws, including applying vendor patches for the deserialization vulnerability in Microsoft Office to prevent exploitation.
Establishes secure configuration settings for Microsoft Office, such as enabling Protected View to sandbox untrusted documents and mitigate deserialization attacks.
Deploys malicious code protection mechanisms like antivirus and EDR to scan, block, or detect Office files exploiting the deserialization vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization vulnerability in Office enables arbitrary code execution/privilege escalation via malicious file opened by user (T1204.002) and direct exploitation for local privilege escalation (T1068).
NVD Description
Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2025-47994 is a deserialization of untrusted data vulnerability (CWE-502) affecting Microsoft Office. Published on 2025-07-08, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
A local unauthorized attacker (PR:N) can exploit this vulnerability with low attack complexity (AC:L), but it requires user interaction (UI:R), such as opening a malicious file. Successful exploitation allows privilege escalation on the local system, enabling high-level control over the affected machine without changing the scope of impact (S:U).
The Microsoft Security Response Center (MSRC) provides details on mitigation and patches in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47994.
Details
- CWE(s)