CVE-2025-59231CWE-843

CVE-2025-59231

High ยท published October 14, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

โšก An unauthorized attacker can execute code locally in Microsoft Office Excel, using a crafty type confusion bug! Think of this vulnerability like a restaurant that serves dishes but doesn't check the recipe โ€” a chef could swap in any ingredient without inspection, leading to unexpected and potentially harmful results! If exploited, this vulnerability could allow an attacker to run their code on your machine, possibly stealing data or installing malware. The consequences could be devastating if sensitive information is exposed or systems are compromised, giving the attacker full control!

Put simply

Think of this vulnerability like a restaurant that serves dishes but doesn't check the recipe โ€” a chef could swap in any ingredient without inspection, leading to unexpected and potentially harmful results! This type confusion vulnerability in Microsoft Office Excel allows attackers to manipulate how data types are interpreted, enabling arbitrary code execution when an incompatible type is accessed.

What to do

If exploited, this vulnerability could allow an attacker to run their code on your machine, possibly stealing data or installing malware. The consequences could be devastating if sensitive information is exposed or systems are compromised, giving the attacker full control! Update Microsoft Office Excel to the latest version as soon as possible to mitigate this issue. Regularly check for patches and updates to ensure your software remains secure. Moreover, educate users to be cautious with Excel files from unknown sources. You've got this! By staying vigilant and applying the latest updates, you can keep your systems safe and secure! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
7.8 ยท HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00525 ยท 43.7th percentile
Weakness
CWE-843 ยท Access of Resource Using Incompatible Type ('Type Confusion')
Published
2025-10-14T21:16Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versionsโ€”
microsoft/365_appsall versionsโ€”
microsoft/excelall versionsโ€”
microsoft/excelall versionsโ€”
microsoft/officeall versionsโ€”
microsoft/officeall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_online_server< 16.0.10417.2005916.0.10417.20059
References (1)
EPSS history
Timeline
  • 14 OCT 17:00Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5