CVE-2025-49697
Published: 08 July 2025
Summary
CVE-2025-49697 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 25.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-49697, published on 2025-07-08, is a heap-based buffer overflow vulnerability (CWE-122) affecting Microsoft Office. The issue carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
The vulnerability can be exploited by an unauthorized local attacker requiring only low-complexity techniques, no privileges, and no user interaction. Successful exploitation allows the attacker to execute arbitrary code on the affected system.
Microsoft's Security Response Center provides mitigation and patching guidance in the update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49697.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20561
Vulnerability details
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in Microsoft Office directly enables local arbitrary code execution via client application exploitation (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely flaw remediation through patching the heap-based buffer overflow vulnerability in Microsoft Office as specified in CVE-2025-49697.
Implements memory protection mechanisms such as ASLR and DEP that directly mitigate heap-based buffer overflow exploits enabling arbitrary code execution.
Provides vulnerability scanning to identify Microsoft Office installations affected by CVE-2025-49697 for subsequent remediation.