CVE-2025-58732CWE-416

Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability

High · published October 14, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

⚡ A crafty use after free in Inbox COM Objects could allow an unauthorized attacker to slip inside your system and execute code locally! 😱 Think of it like a restaurant that forgot to check if the chef had really left the kitchen. An unauthorized person could waltz in and cook whatever they wanted, potentially ruining the whole meal! If exploited, this vulnerability could allow malicious code execution, giving attackers the freedom to manipulate or steal sensitive data. Imagine someone not just peeking into your file cabinets but rearranging everything or even taking important documents out of your office!

Put simply

Think of it like a restaurant that forgot to check if the chef had really left the kitchen. An unauthorized person could waltz in and cook whatever they wanted, potentially ruining the whole meal! This vulnerability occurs when the Inbox COM Objects fail to properly manage memory, allowing an unauthorized attacker to execute arbitrary code due to the program's failure to handle freed memory correctly.

What to do

If exploited, this vulnerability could allow malicious code execution, giving attackers the freedom to manipulate or steal sensitive data. Imagine someone not just peeking into your file cabinets but rearranging everything or even taking important documents out of your office! To mitigate this issue, patch to the latest version of Inbox as soon as it becomes available. Ensure that your environment is configured to limit access to COM objects and audit your security settings regularly. You can tackle this! Stay updated with your patches, and you’ll keep your system secure in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00474 · 40.0th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-14T17:00Z
EPSS history
Timeline
  • 14 OCT 17:00Z
    Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability
    cvelistv5