CVE-2025-58734CWE-416

Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability

High · published October 14, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

⚡ A use-after-free vulnerability in Inbox COM Objects could let an unauthorized attacker run malicious code locally! 😱 Think of it like a waiter serving food that’s already been eaten — the connection to the meal (or in this case, the memory) is still thought to be intact, but it can lead to some serious food poisoning! If exploited, this vulnerability could allow attackers to execute arbitrary code on your system, leading to data breaches, system crashes, or even unauthorized control of your device. This could be absolutely devastating for individual users and organizations alike!

Put simply

Think of it like a waiter serving food that’s already been eaten — the connection to the meal (or in this case, the memory) is still thought to be intact, but it can lead to some serious food poisoning! This vulnerability arises when a COM object is freed from memory but still being referenced, allowing attackers to manipulate the program’s control flow, resulting in the execution of their own code.

What to do

If exploited, this vulnerability could allow attackers to execute arbitrary code on your system, leading to data breaches, system crashes, or even unauthorized control of your device. This could be absolutely devastating for individual users and organizations alike! To safeguard your systems, ensure that the software using these COM objects is updated to the latest version with the patch addressing CVE-2025-58734. Additionally, review your system for any unauthorized access and implement stricter access controls. 🛡️ You've got this! Take these steps, and you'll be well on your way to securing your environment! 💪✨

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-14T17:01Z
EPSS history
Timeline
  • 14 OCT 17:01Z
    Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability
    cvelistv5