CVE-2025-62199CWE-416

CVE-2025-62199

High · published November 11, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
56.6
In the wild
Unconfirmed
What it is

⚡ A sneaky use-after-free flaw in Microsoft Office could let unauthorized attackers execute code locally—yikes! 🔥 Imagine a restaurant that serves up delicious meals, but one day, a former employee slips in and takes over the kitchen with outdated recipes that shouldn't even be on the menu. This vulnerability gives attackers unwarranted access to your Office files, allowing them to dish out whatever malicious code they want, all under the radar! With this vulnerability, an attacker could run arbitrary code on your system, potentially leading to data theft, system corruption, or even full system takeover. It’s not just a mild annoyance; it’s a full-blown security breach waiting to happen!

Put simply

Imagine a restaurant that serves up delicious meals, but one day, a former employee slips in and takes over the kitchen with outdated recipes that shouldn't even be on the menu. This vulnerability gives attackers unwarranted access to your Office files, allowing them to dish out whatever malicious code they want, all under the radar! The use-after-free vulnerability in Microsoft Office occurs when memory is freed but then still accessed by the program, allowing attackers to manipulate this memory and execute code unexpectedly. This flaw can be exploited by an unauthorized user who cleverly interacts with the vulnerable component.

What to do

With this vulnerability, an attacker could run arbitrary code on your system, potentially leading to data theft, system corruption, or even full system takeover. It’s not just a mild annoyance; it’s a full-blown security breach waiting to happen! To stay safe, immediately update Microsoft Office to the latest version where this issue has been patched. Also, consider implementing stricter access controls to your systems to limit any potential exploits. Don’t let just anyone waltz into your digital kitchen! You’ve got this! By taking these steps, you’ll have your defenses up in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00815 · 56.6th percentile
Weakness
CWE-416 · Use After Free
Published
2025-11-11T23:15Z
Affected products (11)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/365_appsall versions—
microsoft/365_copilot< 16.0.19426.2004416.0.19426.20044
microsoft/excelall versions—
microsoft/excelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
References (3)
EPSS history
Timeline
  • 11 NOV 17:59Z
    Microsoft Office Remote Code Execution Vulnerability
    cvelistv5