CVE-2025-59243CWE-416

CVE-2025-59243

High · published October 14, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

⚡ A clever use-after-free flaw in Microsoft Excel can allow unauthorized attackers to execute code on your machine — yikes! 💻 Think of it like opening a door that leads to a room with old, faulty wiring. Once you’re inside, a flick of a switch could overload the system and cause chaos. An attacker could exploit this vulnerability to run arbitrary code locally, potentially gaining access to sensitive data, altering files, or even establishing a foothold for more malicious activities. This could lead to serious breaches of privacy and integrity, causing absolute havoc for users and organizations alike.

Put simply

Think of it like opening a door that leads to a room with old, faulty wiring. Once you’re inside, a flick of a switch could overload the system and cause chaos. This use-after-free vulnerability occurs when a certain object in memory is accessed after it has been freed, allowing attackers to manipulate that memory and execute their own code.

What to do

An attacker could exploit this vulnerability to run arbitrary code locally, potentially gaining access to sensitive data, altering files, or even establishing a foothold for more malicious activities. This could lead to serious breaches of privacy and integrity, causing absolute havoc for users and organizations alike. To mitigate this risk, ensure you immediately update Microsoft Excel to the latest version that includes the patch for CVE-2025-59243. Regularly audit your software for updates and consider enabling additional security features like Application Guard to enhance protection. You've got this! Follow these steps and secure your Excel environment today! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00449 · 38.0th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-14T21:16Z
Affected products (6)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/365_appsall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
References (1)
EPSS history
Timeline
  • 14 OCT 17:00Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5