CVE-2025-47173: Microsoft 365 Apps RCE Vulnerability

CVE-2025-47173 Overview

CVE-2025-47173 is an improper input validation vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally. This vulnerability stems from insufficient validation of user-supplied input within Microsoft Office applications, enabling attackers to craft malicious documents or files that, when opened by a victim, can execute arbitrary code on the local system.

Critical Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with the privileges of the current user. If the user has administrative rights, the attacker could take complete control of the affected system, install programs, view/change/delete data, or create new accounts with full user rights.

Affected Products

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2016, 2019
• Microsoft Office Long Term Servicing Channel 2021 (Windows and macOS)
• Microsoft Office Long Term Servicing Channel 2024 (Windows and macOS)

Discovery Timeline

• 2025-06-10 - CVE-2025-47173 published to NVD
• 2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-47173

Vulnerability Analysis

This vulnerability is classified under CWE-641 (Improper Restriction of Names for Files and Other Resources). The flaw exists in how Microsoft Office applications handle and validate input data, particularly when processing certain file types or embedded content. When a user opens a specially crafted malicious document, the improper input validation allows an attacker to bypass security controls and execute arbitrary code within the context of the user's session.

The local attack vector requires user interaction—specifically, the victim must open a malicious file provided by the attacker. This could be delivered through phishing emails, compromised websites, or file-sharing platforms. Once the malicious document is opened, the vulnerability can be exploited without requiring any privileges from the attacker, though the code execution occurs with whatever privileges the current user holds.

Root Cause

The root cause of CVE-2025-47173 lies in improper input validation within Microsoft Office's file parsing and processing routines. When handling certain input data, the application fails to properly sanitize or validate user-controlled content before processing it. This creates an opportunity for attackers to inject malicious payloads that are interpreted and executed by the Office application, rather than being rejected or safely handled.

The vulnerability is specifically related to improper restriction of names for files and other resources (CWE-641), suggesting that the input validation failure may involve how Office handles file names, paths, or resource identifiers within documents.

Attack Vector

The attack vector for CVE-2025-47173 is local, meaning the attacker must convince a user to open a malicious file on their system. Typical attack scenarios include:

1. Phishing campaigns - Sending crafted Office documents via email that appear legitimate
2. Watering hole attacks - Hosting malicious documents on compromised websites frequented by targets
3. Social engineering - Convincing users to download and open malicious files from various sources

Once the victim opens the malicious document, the improper input validation allows the attacker's payload to execute without requiring any additional authentication or privileges from the attacker's side. The user interaction requirement (opening the file) is the primary barrier to exploitation.

Detection Methods for CVE-2025-47173

Indicators of Compromise

• Unexpected Office application crashes or abnormal behavior when opening documents
• Office processes spawning unusual child processes (e.g., cmd.exe, powershell.exe, wscript.exe)
• Suspicious network connections originating from Office applications
• Modified or newly created files in unexpected locations following document opening

Detection Strategies

• Monitor for Office applications (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) spawning suspicious child processes
• Implement email security controls to scan and sandbox Office documents before delivery to end users
• Deploy endpoint detection and response (EDR) solutions capable of detecting malicious document exploitation
• Enable Windows Defender Attack Surface Reduction (ASR) rules for Office applications

Monitoring Recommendations

• Enable detailed logging for Office application events and Windows Security events
• Monitor for process creation events where parent process is an Office application
• Implement file integrity monitoring on critical system directories
• Track network connections initiated by Office processes for anomalous destinations

How to Mitigate CVE-2025-47173

Immediate Actions Required

• Apply the latest security updates from Microsoft for all affected Office products immediately
• Implement Protected View and Application Guard for Office to sandbox untrusted documents
• Educate users about the risks of opening documents from untrusted sources
• Consider temporarily blocking Office documents from external email sources until patching is complete

Patch Information

Microsoft has released security updates to address this vulnerability. Organizations should apply the patches available through the Microsoft Security Update Guide for CVE-2025-47173. Updates are available for Microsoft 365 Apps, Office 2016, Office 2019, and Office Long Term Servicing Channel versions 2021 and 2024 for both Windows and macOS platforms.

Ensure automatic updates are enabled for Microsoft 365 Apps, or manually download and apply patches through Windows Update, Microsoft Update Catalog, or your organization's patch management system.

Workarounds

• Enable Protected View for files originating from the Internet, unsafe locations, and Outlook attachments
• Configure Office to open documents from untrusted sources in Application Guard
• Disable macros and active content in Office documents by default
• Implement strict email filtering to quarantine suspicious Office attachments for manual review
• Use Group Policy to enforce Office security settings across the organization

# PowerShell: Check Office version and update status
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" | Select-Object -Property VersionToReport, UpdateChannel

# Force Office update via command line
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user