CVE-2025-47957
published 2025-06-10CVE-2025-47957: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
PriorityP356high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EXPLOIT
EPSS
1.21%
64.9th percentile
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_365_apps_for_enterprise | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2021 | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2024 | >= 16.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | office_long_term_servicing_channel | — | — |
| microsoft | office_long_term_servicing_channel | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_32-bit_systems | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_64-bit_systems | — | — |
| msrc | microsoft_office_ltsc_2021_for_32-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2024_for_32-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2024_for_64-bit_editions | — | — |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.4HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w6vw-7jjr-cmhh: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally
ghsa_unreviewed·2025-06-10
CVE-2025-47957 [HIGH] CWE-416 GHSA-w6vw-7jjr-cmhh: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft
Microsoft Word Remote Code Execution Vulnerability
vendor_msrc·2025-06-10·CVSS 8.4
CVE-2025-47957 [HIGH] CWE-416 Microsoft Word Remote Code Execution Vulnerability
Microsoft Word Remote Code Execution Vulnerability
Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
FAQ: Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
FAQ: Are the updates for the Microsoft 365 for Office currently available?
The security update for Microsoft 365 are not immediately available. The updates will be released as soon as possible, and when they are available, customers will be notified via a revision to this CVE information.
FAQ: According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is
No detection rules found.
2025-06-10
Published