CVE-2025-47994

HIGH

Microsoft 365 Apps - Insecure Deserialization

Title source: rule

Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.

CVSS v3 7.8

EPSS 0.0028

EPSS Percentile 51.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-502

Status published

microsoft/365_apps

microsoft/office

microsoft/office_long_term_servicing_channel

microsoft/sharepoint_enterprise_server

Published Jul 08, 2025

Tracked Since Feb 18, 2026