CVE-2025-59221CWE-416

Microsoft Word Remote Code Execution Vulnerability

High · published October 14, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

⚡ A sneaky use-after-free vulnerability in Microsoft Office Word could let unauthorized attackers execute code on your machine – perfect for a covert takeover! 🔥 Think of it like a restaurant serving leftovers without properly labeling them — you never know what you might get! In this case, the leftover memory can be exploited to run malicious code. 🍽️ If exploited, this vulnerability allows attackers to run arbitrary code locally, potentially giving them control over your system. Imagine a hacker slipping into your workspace and tinkering with your files or applications without you even noticing — absolutely devastating!

Put simply

Think of it like a restaurant serving leftovers without properly labeling them — you never know what you might get! In this case, the leftover memory can be exploited to run malicious code. 🍽️ This vulnerability occurs when Word does not properly manage memory, allowing attackers to use freed memory regions to execute their own code. Essentially, it creates an opportunity to hijack code execution on vulnerable systems.

What to do

If exploited, this vulnerability allows attackers to run arbitrary code locally, potentially giving them control over your system. Imagine a hacker slipping into your workspace and tinkering with your files or applications without you even noticing — absolutely devastating! To protect yourself, make sure to update Microsoft Office to the latest version immediately. Additionally, always enable automatic updates to safeguard against future vulnerabilities. Regularly audit your systems for any unauthorized access as a precaution. 🛡️ You've got this! By following these steps, you'll be one step closer to securing your system from potential attacks! 💪✨

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00387 · 31.6th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-14T17:01Z
EPSS history
Timeline
  • 14 OCT 17:01Z
    Microsoft Word Remote Code Execution Vulnerability
    cvelistv5