CVE-2025-59238CWE-416

CVE-2025-59238

High Β· published October 14, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

⚑ A crafty attacker might exploit a use-after-free vulnerability in Microsoft Office PowerPoint, allowing them to execute code locally β€” yikes! 😱 Think of this like a waiter at a restaurant who accidentally takes your order from the previous table and serves it to the next guest β€” an unsuspecting user winds up with someone else's malicious meal instead of their intended dish! 🍽️ With this vulnerability, an attacker can run arbitrary code on a victim's machine, potentially leading to unauthorized access, data theft, or even complete control over the system. It’s like handing over the keys to your digital fortress without even realizing it! πŸ”‘

Put simply

Think of this like a waiter at a restaurant who accidentally takes your order from the previous table and serves it to the next guest β€” an unsuspecting user winds up with someone else's malicious meal instead of their intended dish! 🍽️ This use-after-free flaw occurs when PowerPoint improperly manages memory, allowing an attacker to manipulate the application's runtime environment and inject malicious code.

What to do

With this vulnerability, an attacker can run arbitrary code on a victim's machine, potentially leading to unauthorized access, data theft, or even complete control over the system. It’s like handing over the keys to your digital fortress without even realizing it! πŸ”‘ Update Microsoft Office PowerPoint to the latest version immediately to mitigate this vulnerability. Additionally, consider enabling all available security features to enhance your defense against potential exploits. πŸ”’ You've got this! With a swift update and some vigilance, you'll keep your systems safe and secure! πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
7.8 Β· HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00381 Β· 30.8th percentile
Weakness
CWE-416 Β· Use After Free
Published
2025-10-14T21:16Z
Affected products (9)
ProductVersionsFixed in
microsoft/365_appsall versionsβ€”
microsoft/365_appsall versionsβ€”
microsoft/officeall versionsβ€”
microsoft/officeall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/powerpointall versionsβ€”
References (1)
EPSS history
Timeline
  • 14 OCT 17:01Z
    Microsoft PowerPoint Remote Code Execution Vulnerability
    cvelistv5