CVE-2025-47175
published 2025-06-10CVE-2025-47175: Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
PriorityP354high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
2.05%
79.1th percentile
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_365_apps_for_enterprise | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_2019 | >= 19.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2021 | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2024 | >= 16.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_for_mac_2021 | >= 16.0.1 < 16.98.25060824 | 16.98.25060824 |
| microsoft | microsoft_office_ltsc_for_mac_2024 | >= 16.0.0 < 16.98.25060824 | 16.98.25060824 |
| microsoft | microsoft_powerpoint_2016 | >= 16.0.0 < 16.0.5504.1000 | 16.0.5504.1000 |
| microsoft | office | — | — |
| microsoft | office_long_term_servicing_channel | — | — |
| microsoft | office_long_term_servicing_channel | — | — |
| microsoft | powerpoint | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_32-bit_systems | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_64-bit_systems | — | — |
| msrc | microsoft_office_2019_for_32-bit_editions | — | — |
| msrc | microsoft_office_2019_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_32-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2024_for_32-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2024_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_for_mac_2021 | — | — |
| msrc | microsoft_office_ltsc_for_mac_2024 | — | — |
| msrc | microsoft_powerpoint_2016 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2rm9-pcmr-fvfj: Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally
ghsa_unreviewed·2025-06-10
CVE-2025-47175 [HIGH] CWE-416 GHSA-2rm9-pcmr-fvfj: Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
Microsoft
Microsoft PowerPoint Remote Code Execution Vulnerability
vendor_msrc·2025-06-10·CVSS 7.8
CVE-2025-47175 [HIGH] CWE-416 Microsoft PowerPoint Remote Code Execution Vulnerability
Microsoft PowerPoint Remote Code Execution Vulnerability
Description: Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
FAQ: Are the updates for the Microsoft 365 for Office currently available?
The security update for Microsoft 365 are not immediately available. The updates will be released as soon as possible, and when they are available, customers will be notified via a revision to this CVE information.
FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
FAQ: According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execu
No detection rules found.
2025-06-10
Published