Summary
Microsoft heeft kwetsbaarheden verholpen in Office producten.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om zich verhoogde rechten toe te kennen en willekeurige code uit te voeren in de context van het slachtoffer en zo mogelijk toegang te krijgen tot gevoelige gegevens in de context van het slachtoffer.
Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide bestand te openen, of link te volgen.
```
Microsoft AutoUpdate (MAU):
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-47968 | 7.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Microsoft Office SharePoint:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-47163 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2025-47166 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2025-47172 | 8.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Microsoft Office Outlook:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-47171 | 6.70 | Uitvoeren van willekeurige code |
| CVE-2025-47176 | 7.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Microsoft Office Word:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-47957 | 8.40 | Uitvoeren van willekeurige code |
| CVE-2025-47168 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2025-47169 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2025-47170 | 7.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Microsoft Office PowerPoint:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-47175 | 7.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Microsoft Office:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-47162 | 8.40 | Uitvoeren van willekeurige code |
| CVE-2025-47953 | 8.40 | Uitvoeren van willekeurige code |
| CVE-2025-47164 | 8.40 | Uitvoeren van willekeurige code |
| CVE-2025-47167 | 8.40 | Uitvoeren van willekeurige code |
| CVE-2025-47173 | 7.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Microsoft Office Excel:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-47165 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2025-47174 | 7.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
```
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 18
-
High 8.8CVE-2025-47163 EPSS 22%
Microsoft SharePoint Server Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 8.4
Microsoft Office Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 8.4
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 8.4
Microsoft Office Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 8.4
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 8.4CVE-2025-47957 Public exploit
Microsoft Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
High 7.8CVE-2025-47165 Public exploit
Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Office Remote Code Execution Vulnerability
Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8CVE-2025-47175 Public exploit
Microsoft PowerPoint Remote Code Execution Vulnerability
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
-
High 7.8CVE-2025-47176 Public exploit
Microsoft Outlook Remote Code Execution Vulnerability
'.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.
-
High 7.8
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
Improper input validation in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.
-
Medium 6.7CVE-2025-47171 Public exploit
Microsoft Outlook Remote Code Execution Vulnerability
Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.
Revision history
-
#1.0.0
Initiele versie