CVE-2025-58735CWE-416

Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability

High · published October 14, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

⚡ A pesky use after free vulnerability lurks in Inbox COM Objects, allowing an unauthorized attacker to run code locally. This is no small matter! Think of this like a barista who accidentally leaves a steaming coffee pot on the counter after pouring, allowing anyone to swoop in and take a sip—only this time, it's malicious code instead of a warm drink! ☕️ An attacker can exploit this flaw to execute arbitrary code on vulnerable systems, potentially gaining access to sensitive information or even taking control of the machine. The consequences could be disastrous, leading to data leaks or unauthorized actions!

Put simply

Think of this like a barista who accidentally leaves a steaming coffee pot on the counter after pouring, allowing anyone to swoop in and take a sip—only this time, it's malicious code instead of a warm drink! ☕️ This vulnerability occurs when the application fails to properly manage memory, allowing attackers to access freed memory that can still contain executable code. This could lead to full remote code execution on the local machine.

What to do

An attacker can exploit this flaw to execute arbitrary code on vulnerable systems, potentially gaining access to sensitive information or even taking control of the machine. The consequences could be disastrous, leading to data leaks or unauthorized actions! To mitigate this vulnerability, patch your system to the latest version as soon as it’s available. Also, review your memory management practices, especially around the use of COM Objects, to prevent future issues. You've got this! Stay vigilant, follow the steps, and you’ll keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00474 · 40.0th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-14T17:00Z
EPSS history
Timeline
  • 14 OCT 17:00Z
    Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability
    cvelistv5