CVE-2025-59224CWE-416

CVE-2025-59224

High ยท published October 14, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

โšก An unauthorized attacker can exploit a use-after-free vulnerability in Microsoft Excel to execute code locally! This means your spreadsheet could become a gateway for mischief! Think of it as a chef who leaves a hot pan on the stove without supervision โ€” if someone wanders into the kitchen, they could cook up some trouble without anyone noticing. An attacker could gain control of the system, potentially accessing sensitive information or installing malicious software. The implications could be absolutely devastating, especially if sensitive data is involved or if it spreads to other systems.

Put simply

Think of it as a chef who leaves a hot pan on the stove without supervision โ€” if someone wanders into the kitchen, they could cook up some trouble without anyone noticing. This use-after-free vulnerability occurs when Excel accesses memory that has already been freed, allowing attackers to execute arbitrary code. A crafty attacker could leverage this flaw to run malicious scripts without proper authorization.

What to do

An attacker could gain control of the system, potentially accessing sensitive information or installing malicious software. The implications could be absolutely devastating, especially if sensitive data is involved or if it spreads to other systems. To protect yourself, update Microsoft Excel to the latest version as soon as possible. Ensure that automatic updates are enabled to receive patches promptly, and consider reviewing your security settings to harden your defenses. You've got this! With these steps, you're on your way to securing your environment. ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
7.8 ยท HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00381 ยท 30.8th percentile
Weakness
CWE-416 ยท Use After Free
Published
2025-10-14T21:16Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versionsโ€”
microsoft/365_appsall versionsโ€”
microsoft/excelall versionsโ€”
microsoft/excelall versionsโ€”
microsoft/officeall versionsโ€”
microsoft/officeall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_online_server< 16.0.10417.2005916.0.10417.20059
References (1)
EPSS history
Timeline
  • 14 OCT 17:01Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5