CVE-2025-47175 Overview
CVE-2025-47175 is a use-after-free vulnerability [CWE-416] in Microsoft Office PowerPoint that enables local code execution. An attacker can craft a malicious PowerPoint file that, when opened by a user, triggers memory corruption in the application. The flaw affects multiple Microsoft Office distributions including Microsoft 365 Apps, Office 2019, Office Long Term Servicing Channel 2021 and 2024, and PowerPoint 2016. Successful exploitation grants the attacker code execution in the context of the current user, with high impact to confidentiality, integrity, and availability. Microsoft published an advisory addressing the issue in June 2025.
Critical Impact
A malicious PowerPoint document opened by a user can trigger arbitrary code execution on the local system with the user's privileges.
Affected Products
- Microsoft 365 Apps (Enterprise)
- Microsoft Office 2019 and Office Long Term Servicing Channel 2021/2024 (Windows and macOS)
- Microsoft PowerPoint 2016
Discovery Timeline
- 2025-06-10 - CVE-2025-47175 published to NVD
- 2025-07-09 - Last updated in NVD database
Technical Details for CVE-2025-47175
Vulnerability Analysis
The vulnerability is a use-after-free condition in Microsoft Office PowerPoint. Use-after-free flaws occur when a program continues to reference memory after that memory has been released back to the allocator. An attacker who controls the contents or layout of the freed region can influence subsequent memory operations to redirect execution. In PowerPoint, parsing a crafted presentation file can free an internal object while leaving a dangling pointer in use, allowing an attacker to replace the freed structure with attacker-controlled data.
Exploitation requires local file processing and user interaction. The victim must open the malicious file, typically delivered through email attachments, web downloads, or file-sharing services. No authentication is required from the attacker. Once the file is opened, the corrupted memory state can be leveraged to hijack control flow and execute arbitrary code in the PowerPoint process. The resulting code runs at the user's privilege level, providing a foothold for credential theft, lateral movement, or follow-on payload delivery.
Root Cause
The root cause is improper management of an object lifetime during PowerPoint document parsing. Specific technical details have not been publicly disclosed by Microsoft.
Attack Vector
The attack vector is local with required user interaction. An attacker delivers a weaponized .pptx or related PowerPoint file and convinces the target to open it. The file triggers the use-after-free during rendering or object handling, leading to local code execution. See the Microsoft CVE-2025-47175 Advisory for vendor guidance.
Detection Methods for CVE-2025-47175
Indicators of Compromise
- Unexpected child processes spawned by POWERPNT.EXE such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
- PowerPoint process crashes or abnormal termination immediately after opening a document, suggesting failed or partial exploitation.
- PowerPoint writing executables, scripts, or DLLs to user-writable directories like %TEMP%, %APPDATA%, or %LOCALAPPDATA%.
- Outbound network connections from POWERPNT.EXE to untrusted hosts shortly after document open events.
Detection Strategies
- Monitor process ancestry for any executable spawned from a parent of POWERPNT.EXE, particularly LOLBins and scripting engines.
- Apply YARA or content-based scanning to inbound PowerPoint files looking for malformed object structures and embedded payloads.
- Correlate Office telemetry with endpoint detection events to flag document opens followed by suspicious memory or process activity.
Monitoring Recommendations
- Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and writing executable content.
- Forward Sysmon process creation, image load, and file create events from endpoints running Microsoft Office to a central SIEM.
- Track EPSS movement for CVE-2025-47175, currently 1.019% (77th percentile), as a signal of increasing exploit activity.
How to Mitigate CVE-2025-47175
Immediate Actions Required
- Apply the June 2025 Microsoft security updates referenced in the Microsoft CVE-2025-47175 Advisory to all affected Office installations.
- Inventory endpoints running Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and PowerPoint 2016 to confirm patch coverage on Windows and macOS hosts.
- Restrict execution of PowerPoint files received from external sources until patching is complete.
Patch Information
Microsoft has issued patches for all affected products through its standard update channels. Administrators should deploy updates via Microsoft Update, Windows Server Update Services (WSUS), Microsoft Configuration Manager, or Intune. Consult the vendor advisory for the specific build numbers that contain the fix for each Office channel.
Workarounds
- Configure Office Protected View and Block macros from running in Office files from the Internet via Group Policy to reduce the chance of automatic content execution.
- Use Microsoft Defender ASR rule Block all Office applications from creating child processes to limit post-exploitation actions.
- Train users to avoid opening unsolicited PowerPoint attachments and to verify sender identity before opening shared presentations.
# Enable the ASR rule blocking Office child process creation (Windows PowerShell)
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
