CVE-2025-47169: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2025-47169 Overview

CVE-2025-47169 is a heap-based buffer overflow vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute arbitrary code locally. The flaw, classified under [CWE-122], affects multiple Microsoft Office products including Microsoft 365 Apps, Microsoft Office 2019, Office LTSC 2021 and 2024, SharePoint Server 2019, SharePoint Enterprise Server 2016, and Microsoft Word 2016. Exploitation requires user interaction, typically opening a crafted document. Successful exploitation gives the attacker the same privileges as the logged-on user, with high impact to confidentiality, integrity, and availability.

Critical Impact
An attacker can achieve arbitrary code execution on the target system by convincing a user to open a malicious Office document, leading to full compromise of user-level data and processes.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024 (including macOS variants)
Microsoft Word 2016, SharePoint Server 2019, SharePoint Enterprise Server 2016

Discovery Timeline

2025-06-10 - CVE-2025-47169 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47169

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in the document parsing logic of Microsoft Office Word. When Word processes a specially crafted file, it writes data past the bounds of a heap-allocated buffer. This memory corruption can be leveraged to overwrite adjacent heap structures, including function pointers or object vtables, leading to control of execution flow.

The attack is local, requires no authentication, but does require user interaction. A victim must open or preview a malicious document delivered through email, web download, or shared storage. Because SharePoint Server is also listed as affected, the parsing component is shared across Office products, broadening the attack surface to server-side document processing in certain configurations.

The vulnerability scores 7.8 on CVSS 3.1 with high impact on confidentiality, integrity, and availability. The EPSS exploit-probability data places it in the mid-range for likelihood, and Microsoft has not reported in-the-wild exploitation.

Root Cause

The root cause is improper validation of size or length fields within a structured document stream before data is copied into a fixed-size heap allocation. The parser trusts attacker-controlled metadata and writes beyond the allocated chunk boundary, corrupting heap metadata or adjacent objects.

Attack Vector

An attacker crafts a malicious Word document containing manipulated record sizes or embedded objects that trigger the overflow during parsing. Delivery channels include phishing emails with attachments, malicious documents hosted on file shares or websites, and documents uploaded to SharePoint where server-side preview or indexing can process the file. Once the user opens the file, code executes in the context of the current user.

No verified public proof-of-concept code is available. See the Microsoft Security Update CVE-2025-47169 advisory for additional technical context.

Detection Methods for CVE-2025-47169

Indicators of Compromise

Unexpected child processes spawned by winword.exe or excel.exe, particularly cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Office applications writing executable files (.exe, .dll, .ps1) to user-writable locations such as %APPDATA%, %TEMP%, or %LOCALAPPDATA%.
Crashes of winword.exe with exception codes consistent with heap corruption (0xC0000374, 0xC0000005) recorded in Windows Error Reporting.

Detection Strategies

Monitor process-creation telemetry for Office applications launching scripting interpreters or LOLBins immediately after a document is opened.
Inspect inbound email attachments and SharePoint uploads for Word documents containing malformed OLE streams or unusually large record headers.
Correlate document-open events with subsequent network connections to uncategorized or newly registered domains.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting code into other processes.
Forward Sysmon Event IDs 1 (process creation), 7 (image load), and 11 (file create) from Office hosts to a central analytics platform.
Track Windows Error Reporting entries for repeated winword.exe crashes across multiple users, which can indicate an exploitation attempt or a broadly distributed weaponized document.

How to Mitigate CVE-2025-47169

Immediate Actions Required

Apply Microsoft's June 2025 security updates to all affected Office, Microsoft 365 Apps, and SharePoint installations as documented in the MSRC advisory.
Inventory endpoints and servers running Office 2016, 2019, LTSC 2021, LTSC 2024, and SharePoint 2016/2019 to confirm patch coverage.
Restrict document delivery from untrusted sources at the email gateway and enforce Protected View for files originating from the internet.

Patch Information

Microsoft has released security updates addressing CVE-2025-47169. Refer to the Microsoft Security Update CVE-2025-47169 guidance for the specific KB numbers and update channels that apply to each affected product, including click-to-run channels for Microsoft 365 Apps and MSI-based updates for perpetual Office releases.

Workarounds

Enforce Protected View and Office Application Guard for documents from external sources to contain parsing in an isolated environment.
Disable automatic document preview in Outlook and Windows Explorer to reduce inadvertent triggering of the parser.
Configure Microsoft Defender ASR rules to block Office child-process creation, code injection, and Win32 API calls from Office macros.

bash

# Enable key Attack Surface Reduction rules via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A, `
  3B576869-A4EC-4529-8536-B80A7769E899, `
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled