PT-2025-24875 · Microsoft · Outlook

Arnold Osipov + 2 · Published 2025-06-10 · Updated 2026-02-15 · CVE-2025-47176

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office Outlook (affected versions not specified)

Description A critical issue in Microsoft Office Outlook allows an authorized attacker to execute code locally. This is due to a path traversal problem. The issue can be exploited by attackers using social engineering to gain low-privilege access. There are reports of this issue being actively exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Command Injection

Weakness Enumeration

CWE-22

CWE-77

CWE-35

Related Identifiers

BDU:2025-07074

CVE-2025-47176

Affected Products

Outlook

References · 23

• https://nvd.nist.gov/vuln/detail/CVE-2025-47176 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47176 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47176 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07074 · Security Note
• https://t.me/hybgl/2119 · Telegram Post
• https://twitter.com/AgniOpsIn/status/2022949570188316916 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/1933017519528517748 · Twitter Post
• https://twitter.com/morphisec/status/1975197620013269055 · Twitter Post
• https://twitter.com/CVEnew/status/1932512931176210775 · Twitter Post
• https://twitter.com/decabyte_info/status/1932719374563225988 · Twitter Post
• https://twitter.com/LanWanNinja/status/1932756614831915025 · Twitter Post
• https://twitter.com/osipov_ar/status/1932884311436317039 · Twitter Post
• https://t.me/proxy_bar/2667 · Telegram Post
• https://twitter.com/windowsforum/status/1932497765575069821 · Twitter Post
• https://twitter.com/transilienceai/status/1934599772863942815 · Twitter Post