CVE-2025-53733
Published: 12 August 2025
Summary
CVE-2025-53733 is a high-severity Incorrect Conversion between Numeric Types (CWE-681) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 33.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation directly corrects the incorrect numeric type conversion vulnerability in Microsoft Office Word via vendor patches, preventing local code execution.
Memory protection safeguards such as DEP and ASLR prevent unauthorized code execution resulting from the type conversion error in Word.
Secure configuration settings for Microsoft Office Word, including Protected View, mitigate exploitation of document parsing vulnerabilities like this numeric conversion flaw.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Type confusion flaw in Word directly enables local arbitrary code execution via client application exploitation (T1203).
NVD Description
Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Deeper analysisAI
CVE-2025-53733, published on 2025-08-12, is a vulnerability stemming from incorrect conversion between numeric types (CWE-681) in Microsoft Office Word. This flaw allows an unauthorized attacker to execute code locally and carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impacts on confidentiality, integrity, and availability.
The vulnerability can be exploited by an unauthorized attacker with local access to the affected system. Exploitation requires low complexity, no privileges, and no user interaction, enabling the attacker to achieve arbitrary code execution locally within the context of Microsoft Office Word.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53733 provides guidance on mitigation and related updates.
Details
- CWE(s)