CVE-2025-59223CWE-416

CVE-2025-59223

High · published October 14, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

⚡ A sneaky "use after free" situation in Microsoft Excel could let attackers run code on your system without a fuss! Think of it like a waiter clearing out a table too soon; they take the plates away before checking if there’s still something valuable left. In this case, Excel is forgetting to completely clean up, allowing unauthorized users to step in and take control while the system thinks it’s all clear! An attacker could exploit this vulnerability to execute arbitrary code on your local machine, potentially gaining full access to your data and applications—absolutely devastating! Imagine someone sneaking into your office and taking over your computer while you’re away. Time to take action!

Put simply

Think of it like a waiter clearing out a table too soon; they take the plates away before checking if there’s still something valuable left. In this case, Excel is forgetting to completely clean up, allowing unauthorized users to step in and take control while the system thinks it’s all clear! This vulnerability allows unauthorized attackers to execute code locally due to improper memory management in Microsoft Excel, specifically a use after free flaw that occurs when memory is freed but still accessible.

What to do

An attacker could exploit this vulnerability to execute arbitrary code on your local machine, potentially gaining full access to your data and applications—absolutely devastating! Imagine someone sneaking into your office and taking over your computer while you’re away. Time to take action! To protect yourself, make sure to update Microsoft Office to the latest version that addresses this flaw. Regularly check for updates and consider implementing strict user access controls to limit vulnerabilities. 🛡️ You've got this! Stay proactive, follow these steps, and keep your system secure! 💪😊

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00381 · 30.8th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-14T21:16Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/365_appsall versions—
microsoft/excelall versions—
microsoft/excelall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_online_server< 16.0.10417.2005916.0.10417.20059
References (1)
EPSS history
Timeline
  • 14 OCT 17:01Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5