CWE-641
AllowedImproper Restriction of Names for Files and Other Resources
Abstraction: Base · Status: Incomplete
The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.
31 vulnerabilities reference this CWE, most recent first.
GHSA-W7FW-3VX9-4JR9
Vulnerability from github – Published: 2025-06-10 18:32 – Updated: 2025-06-10 18:32Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
{
"affected": [],
"aliases": [
"CVE-2025-47953"
],
"database_specific": {
"cwe_ids": [
"CWE-641"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-10T17:24:01Z",
"severity": "HIGH"
},
"details": "Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.",
"id": "GHSA-w7fw-3vx9-4jr9",
"modified": "2025-06-10T18:32:31Z",
"published": "2025-06-10T18:32:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47953"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47953"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Do not allow users to control names of resources used on the server side.
Mitigation
Perform allowlist input validation at entry points and also before consuming the resources. Reject bad file names rather than trying to cleanse them.
Mitigation
Make sure that technologies consuming the resources are not vulnerable (e.g. buffer overflow, format string, etc.) in a way that would allow code execution if the name of the resource is malformed.
No CAPEC attack patterns related to this CWE.