CVE-2025-59234CWE-416

CVE-2025-59234

High · published October 14, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

⚡ A sneaky use-after-free flaw in Microsoft Office could let unauthorized attackers run code on your local machine! 🔥 Think of this as a librarian forgetting to remove a book from the catalog after it's been checked out—anyone can now access that book without permission! 📚 If exploited, this vulnerability could lead to code execution on your device, allowing attackers to potentially steal sensitive information or disrupt operations. It's like leaving a backdoor unlocked in your home, inviting unwanted intruders in!

Put simply

Think of this as a librarian forgetting to remove a book from the catalog after it's been checked out—anyone can now access that book without permission! 📚 This use-after-free vulnerability occurs when Microsoft Office fails to properly manage memory, allowing attackers to exploit freed memory to execute arbitrary code. It’s a dangerous oversight that can have serious repercussions for your system's integrity.

What to do

If exploited, this vulnerability could lead to code execution on your device, allowing attackers to potentially steal sensitive information or disrupt operations. It's like leaving a backdoor unlocked in your home, inviting unwanted intruders in! To mitigate this risk, ensure you update Microsoft Office to the latest version available. Regularly review your security settings and consider enabling additional protections like antivirus software to add layers of defense. 🛡️ You've got this! With a quick update, you can lock down your system and keep those intruders out! 🚀

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00599 · 48.0th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-14T21:16Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/365_appsall versions—
microsoft/365_copilot< 16.0.19328.2000016.0.19328.20000
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
References (1)
EPSS history
Timeline
  • 14 OCT 17:00Z
    Microsoft Office Remote Code Execution Vulnerability
    cvelistv5