CVE-2025-59227CWE-416

CVE-2025-59227

High · published October 14, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

⚡ An unauthorized attacker can execute code locally thanks to a use-after-free vulnerability in Microsoft Office! It's a recipe for chaos! Think of it like a restaurant running out of a key ingredient but still serving meals that require it — diners might get served something unexpected and potentially hazardous. Similarly, this flaw allows an attacker to exploit memory that's already been cleaned up, leading to unforeseen consequences in your system. With this vulnerability, an attacker could potentially gain control over your system, executing any code they desire. This could lead to data theft, unauthorized access, or even a complete system takeover — all while you're blissfully unaware. That's a recipe for disaster!

Put simply

Think of it like a restaurant running out of a key ingredient but still serving meals that require it — diners might get served something unexpected and potentially hazardous. Similarly, this flaw allows an attacker to exploit memory that's already been cleaned up, leading to unforeseen consequences in your system. This use-after-free vulnerability occurs when Microsoft Office software improperly manages memory, allowing attackers to execute arbitrary code in a workspace. Essentially, it fails to correctly handle memory allocation and deallocation, which can be exploited for malicious purposes.

What to do

With this vulnerability, an attacker could potentially gain control over your system, executing any code they desire. This could lead to data theft, unauthorized access, or even a complete system takeover — all while you're blissfully unaware. That's a recipe for disaster! To mitigate this risk, ensure that your Microsoft Office suite is updated to the latest version. Regularly check for patches and improvements from Microsoft to close this security gap. Implement strict access controls to limit exposure to potential attacks. You've got this! Stay proactive and secure your environment today! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00512 · 42.8th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-14T21:16Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/365_appsall versions—
microsoft/365_copilot< 16.0.19328.2000016.0.19328.20000
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
References (1)
EPSS history
Timeline
  • 14 OCT 17:01Z
    Microsoft Office Remote Code Execution Vulnerability
    cvelistv5