CVE-2025-47167 Microsoft CVE debrief

Who should care

Security teams and endpoint administrators responsible for Microsoft Office deployments, especially environments running Office 2016, Office 2019, Microsoft 365 Apps, and Office Long Term Servicing Channel 2021/2024 on Windows or macOS. Organizations that handle untrusted Office files should treat this as a priority.

Technical summary

The supplied vendor and NVD records describe an access-of-resource-using-incompatible-type issue in Microsoft Office, categorized as CWE-843 (type confusion). NVD lists affected CPEs that include Microsoft 365 Apps enterprise, Office 2016, Office 2019, and Office Long Term Servicing Channel 2021 and 2024, with Windows and macOS variants noted in the criteria. The impact is local code execution by an unauthorized attacker, with no privileges required and no user interaction reflected in the provided CVSS vector.

Defensive priority

High. The combination of code execution impact and broad Microsoft Office product coverage makes this a strong patching priority for managed endpoints and productivity suites, even though the attack vector is local.

Recommended defensive actions

• Review and apply the Microsoft security update referenced in the vendor advisory for CVE-2025-47167.
• Prioritize patched rollout for Office 2016, Office 2019, Microsoft 365 Apps, and Office LTSC 2021/2024 across Windows and macOS fleets.
• Validate exposure using the affected CPE ranges listed in NVD and inventory the installed Office channel/version on endpoints.
• Increase scrutiny for unexpected Office documents or local execution paths until patching is complete.
• Confirm whether any compensating controls, such as application control or endpoint hardening, can reduce risk while updates are staged.

Evidence notes

All statements are based on the supplied official corpus: the CVE record, NVD detail data, and the Microsoft security update guide. The record shows a 2025-06-10 publication date and 2025-07-09 modification date. NVD lists the vulnerability status as Analyzed, assigns CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and maps CWE-843. The provided enrichment indicates this CVE is not in CISA KEV.

Official resources