Microsoft Outlook Remote Code Execution Vulnerability

CVE-2025-47171 is a remote code execution vulnerability in Microsoft Office Outlook (rated Important, CVSS 6.7).

1 version

Microsoft id: CVE-2025-47171
Products: Microsoft Office Outlook
Severity: Important
Impact: Remote Code Execution
CVSS: 6.7
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Unlikely
Customer action required: Yes
Release: 2025-Jun
Assigned by: Microsoft
Weakness: CWE-20: Improper Input Validation
MSRC revision: 2.0
Status pages: Outlook status
First captured by us: 13 Nov 2026, 14:57 UTC (from our first import of this list)
Microsoft last modified: 10 Jun 2025, 07:00 UTC
Source: Security updates · open the original at Microsoft

Microsoft's revision notes

Revision 1.0, 2025-06-10: Information published.
Revision 2.0, 2025-06-10: Microsoft is announcing the availability of the security updates for Microsoft Office 365.

Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.

Security updates, 07:00 UTC, 10 Jun 2025

One version so far. If Microsoft edits it, each change shows here with what was removed and added.

First version we captured · 14:57 UTC, 13 Nov
The text as we first saw it
Seen by us 14:57 UTC, 13 Nov · Microsoft's timestamp 07:00 UTC, 10 Jun 2025 · Microsoft's page