CVE-2025-59233CWE-843

CVE-2025-59233

High Β· published October 14, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

⚑ A crafty attacker can exploit a type confusion flaw in Microsoft Excel to run arbitrary code locally! It’s like a magician slipping a decoy into a performance that convinces your audience to believe it’s the real deal. 🎩✨ Imagine a restaurant where a waiter accidentally serves the wrong dish to a customer because they mistook the order. Similarly, this vulnerability allows the application to misinterpret data types, causing unintended consequences. If an attacker takes advantage of this, they could potentially run any code they want on your system, leading to unauthorized access, data leaks, or even complete system compromise. This could be absolutely devastating for your organization!

Put simply

Imagine a restaurant where a waiter accidentally serves the wrong dish to a customer because they mistook the order. Similarly, this vulnerability allows the application to misinterpret data types, causing unintended consequences. This 'type confusion' vulnerability occurs in Microsoft Excel when the application incorrectly processes a resource type, allowing an attacker to execute their own code on the affected system.

What to do

If an attacker takes advantage of this, they could potentially run any code they want on your system, leading to unauthorized access, data leaks, or even complete system compromise. This could be absolutely devastating for your organization! To protect yourself, ensure you're running the latest version of Microsoft Excel by checking for updates. Also, minimize risk by limiting file access and being cautious with unfamiliar documents. Don't delay – take these steps today! You've got this! With a little vigilance and these updates, you’ll keep your system secure and your data safe! πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
7.8 Β· HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00525 Β· 43.7th percentile
Weakness
CWE-843 Β· Access of Resource Using Incompatible Type ('Type Confusion')
Published
2025-10-14T21:16Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versionsβ€”
microsoft/365_appsall versionsβ€”
microsoft/excelall versionsβ€”
microsoft/excelall versionsβ€”
microsoft/officeall versionsβ€”
microsoft/officeall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_online_server< 16.0.10417.2005916.0.10417.20059
References (1)
EPSS history
Timeline
  • 14 OCT 17:00Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5