CVE-2025-47170: Microsoft 365 Apps Use-After-Free Flaw

CVE-2025-47170 Overview

CVE-2025-47170 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word. The flaw allows an unauthorized local attacker to execute arbitrary code on a target system. Exploitation requires user interaction, such as opening a crafted Word document. Microsoft addressed the issue in its June 2025 security update covering Microsoft 365 Apps and Microsoft Office Long Term Servicing Channel 2024 on Windows and macOS.

The vulnerability carries a CVSS 3.1 base score of 7.8 and affects confidentiality, integrity, and availability at high impact. The EPSS probability is 0.673% (71.59 percentile), reflecting moderate predicted exploitation likelihood.

Critical Impact
A crafted Word document can corrupt memory and trigger arbitrary code execution in the context of the user opening the file.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Office Long Term Servicing Channel 2024 (Windows)
Microsoft Office Long Term Servicing Channel 2024 (macOS)

Discovery Timeline

2025-06-10 - CVE-2025-47170 published to NVD
2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-47170

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in Microsoft Word's document parsing logic. Word references a memory object after the allocator has freed it, leading to undefined behavior on subsequent access. An attacker who controls the contents of a malicious document can shape heap state so the freed object is replaced with attacker-controlled data. The resulting dangling pointer dereference allows hijacking of control flow within the Word process.

The attack vector is local and requires user interaction. The victim must open a crafted document delivered through email, web download, or shared storage. Successful exploitation executes code with the privileges of the logged-on user. If the user holds administrative rights, the attacker gains full control of the host.

Root Cause

The root cause is improper lifetime management of a heap object during Word document processing. The application releases a memory allocation but retains and later reuses a pointer to the freed region. This pattern enables type confusion and arbitrary read/write primitives that lead to code execution.

Attack Vector

Delivery typically occurs through phishing emails that contain or link to a weaponized .docx or .doc file. The vulnerability can also be reached through Outlook's preview pane in some configurations. Once the document is rendered, the use-after-free triggers without further user action beyond opening the file.

No public proof-of-concept exploit is currently listed for CVE-2025-47170, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update CVE-2025-47170 advisory for technical specifics released by the vendor.

Detection Methods for CVE-2025-47170

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, including cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Word process crashes or WerFault.exe events tied to WINWORD.EXE referencing access violations in document parsing modules.
Office documents arriving from external senders that contain embedded objects, unusual OLE streams, or obfuscated content.
Outbound network connections initiated by WINWORD.EXE to previously unseen domains or IP addresses.

Detection Strategies

Hunt for process lineage where WINWORD.EXE is the parent of a scripting interpreter or LOLBin, which is a strong indicator of document-based code execution.
Inspect endpoint memory telemetry for write-then-execute patterns and ROP-style behavior originating from the Word process.
Correlate email gateway logs with endpoint document-open events to flag suspect attachments opened after delivery from low-reputation senders.

Monitoring Recommendations

Enable and centralize Microsoft Defender Attack Surface Reduction (ASR) audit events related to Office child processes.
Forward Sysmon Event IDs 1, 7, and 11 to your SIEM and create alerts for Office binaries writing executable content to disk.
Track Office crash telemetry and prioritize investigation of recurring faults in document rendering components across multiple endpoints.

How to Mitigate CVE-2025-47170

Immediate Actions Required

Apply the June 2025 Microsoft security updates for Microsoft 365 Apps and Office LTSC 2024 on all Windows and macOS endpoints.
Verify Office click-to-run and update channels are enabled and reporting current build numbers to your management console.
Block inbound .doc, .docm, and .rtf attachments from untrusted external senders at the email gateway pending patch deployment.
Educate users to avoid opening unsolicited Office documents and to report suspect attachments through internal channels.

Patch Information

Microsoft released a security update on June 10, 2025, addressing CVE-2025-47170. Administrators should consult the Microsoft Security Update CVE-2025-47170 advisory for the exact build numbers per channel. Deploy the update through Microsoft Update, Windows Server Update Services (WSUS), Intune, or your preferred patch management platform.

Workarounds

Enable Protected View for documents originating from the internet and from Outlook attachments.
Configure Microsoft Defender ASR rule Block all Office applications from creating child processes (GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A) in enforce mode.
Disable the Outlook reading pane for external mail to prevent automatic document rendering.
Restrict end users to standard accounts so successful exploitation does not yield administrative privileges.

bash

# Enable the ASR rule to block Office apps from creating child processes (PowerShell, run as admin)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify Office build version meets the patched release
reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v VersionToReport