CVE-2025-47165
published 2025-06-10CVE-2025-47165: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
PriorityP181high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
2.19%
82.3th percentile
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | excel | — | — |
| microsoft | microsoft_365_apps_for_enterprise | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_excel_2016 | >= 16.0.0.0 < 16.0.5504.1000 | 16.0.5504.1000 |
| microsoft | microsoft_office_2019 | >= 19.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2021 | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2024 | >= 16.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_for_mac_2021 | >= 16.0.1 < 16.98.25060824 | 16.98.25060824 |
| microsoft | microsoft_office_ltsc_for_mac_2024 | >= 16.0.0 < 16.98.25060824 | 16.98.25060824 |
| microsoft | office | — | — |
| microsoft | office_long_term_servicing_channel | — | — |
| microsoft | office_long_term_servicing_channel | — | — |
| microsoft | office_online_server | < 16.0.10417.20018 | 16.0.10417.20018 |
| microsoft | office_online_server | >= 16.0.0.0 < 16.0.10417.20018 | 16.0.10417.20018 |
| msrc | microsoft_365_apps_for_enterprise_for_32-bit_systems | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_64-bit_systems | — | — |
| msrc | microsoft_excel_2016 | — | — |
| msrc | microsoft_office_2019_for_32-bit_editions | — | — |
| msrc | microsoft_office_2019_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_32-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2024_for_32-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2024_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_for_mac_2021 | — | — |
| msrc | microsoft_office_ltsc_for_mac_2024 | — | — |
| msrc | office_online_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Delivery mechanism is a macro-enabled Word document (.docm) sent via email or served from an HTTP server; look for .docm files delivered over HTTP on non-standard ports (e.g. 8000). ↗
- →Malicious document uses an AutoOpen macro for automatic execution upon document open; monitor for VBA AutoOpen macro execution in Office documents. ↗
- →Malicious .docm file may be delivered inside a ZIP archive; inspect ZIP attachments containing .docm files. ↗
- →Preview Pane is NOT an attack vector; user interaction (opening the file) is required — focus detection on document open events and macro execution. ↗
- →The exploit script uses win32com Dispatch to Word.Application to programmatically create and arm the malicious document; process creation of WINWORD.EXE spawned by Python/scripting engines may indicate document weaponization. ↗
- ·The exploit PoC targets Microsoft Office LTSC 2024, LTSC 2021, and Microsoft 365 Apps for Enterprise; patches for Microsoft 365 were not immediately available at time of disclosure. ↗
- ·The security update for Microsoft 365 was not immediately available at time of advisory publication; monitor for revision notifications. ↗
- ·Exploit status at time of advisory: not yet exploited in the wild and not publicly disclosed via MSRC, though a public PoC exists on Exploit-DB. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vulncheck7.8HIGH
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-29gg-qvj7-46c7: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally
ghsa_unreviewed·2025-06-10
CVE-2025-47165 [HIGH] CWE-416 GHSA-29gg-qvj7-46c7: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
VulnCheck
Microsoft Office Use After Free
vulncheck·2025·CVSS 7.8
CVE-2025-47165 [HIGH] Microsoft Office Use After Free
Microsoft Office Use After Free
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Affected: Microsoft Office
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://hs-8813571.f.hubspotemail.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250903.pdf
Microsoft
Microsoft Excel Remote Code Execution Vulnerability
vendor_msrc·2025-06-10·CVSS 7.8
CVE-2025-47165 [HIGH] CWE-416 Microsoft Excel Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability
Description: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
FAQ: According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.
For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their
No detection rules found.
2025-06-10
Published
Exploited in the wild