CVE-2025-47953 Microsoft CVE debrief

Who should care

Endpoint and desktop security teams, Microsoft 365/Office administrators, and SOC teams monitoring managed Windows and Office environments should prioritize this CVE. It is especially relevant for organizations running the affected Office families listed by NVD, including Microsoft 365 Apps for enterprise, Office for Android, Office 2016, Office 2019, and Office LTSC 2021/2024.

Technical summary

The official record characterizes CVE-2025-47953 as a local code execution issue in Microsoft Office with CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.4 High). NVD marks Microsoft Office-related products as vulnerable and associates the weakness with CWE-641 in the supplied metadata. Because the attack is local and requires no privileges or user interaction, endpoint exposure and rapid remediation are the main defensive concerns.

Defensive priority

High priority. Although the attack vector is local, the combination of no privileges, no user interaction, and full CIA impact makes this a strong candidate for expedited patching and endpoint-wide exposure review.

Recommended defensive actions

• Review the Microsoft Security Response Center advisory for CVE-2025-47953 and apply the vendor’s fixed builds or mitigation guidance as soon as possible.
• Inventory affected Office deployments, including Microsoft 365 Apps for enterprise, Office 2016/2019, Office LTSC 2021/2024, and Office for Android where applicable.
• Prioritize remediation on managed endpoints used for document handling, especially systems with broad Office usage and elevated business impact.
• Monitor for suspicious local code execution activity on Office endpoints, including unexpected child processes or anomalous Office behavior.
• Validate that patch management, application control, and endpoint protection policies are in place for Office installations across the fleet.

Evidence notes

Based on the official CVE record and NVD detail for CVE-2025-47953. The CVE was published on 2025-06-10 and last modified on 2025-07-09 in the supplied timeline. NVD classifies the issue as analyzed and references the Microsoft advisory. The supplied data does not indicate a KEV listing or known ransomware campaign use. Note: the supplied title/description says use-after-free, while NVD’s weakness field lists CWE-641; treat the exact root-cause label cautiously and rely on Microsoft’s advisory for remediation details.

Official resources