CVE-2025-62201CWE-122

CVE-2025-62201

High · published November 11, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

⚡ A sneaky heap-based buffer overflow in Microsoft Excel could let an unauthorized attacker run code locally—talk about a party crasher! 🎉 Think of it like a crowded elevator where someone can sneak in a suitcase that takes up too much space, causing the entire system to malfunction. When that suitcase bursts open, it spills out all sorts of chaos—just like this vulnerability allows an attacker to execute arbitrary code. If exploited, this vulnerability could give an attacker the keys to your Excel files, allowing them to execute malicious code and potentially compromise the entire system. The results could be absolutely devastating, leading to data leaks or system crashes, disrupting your productivity and security.

Put simply

Think of it like a crowded elevator where someone can sneak in a suitcase that takes up too much space, causing the entire system to malfunction. When that suitcase bursts open, it spills out all sorts of chaos—just like this vulnerability allows an attacker to execute arbitrary code. This vulnerability arises from a heap-based buffer overflow flaw in Microsoft Office Excel, which occurs when the application mishandles memory allocation, allowing an attacker to create conditions that can execute arbitrary code locally.

What to do

If exploited, this vulnerability could give an attacker the keys to your Excel files, allowing them to execute malicious code and potentially compromise the entire system. The results could be absolutely devastating, leading to data leaks or system crashes, disrupting your productivity and security. Immediately update to the latest version of Microsoft Office Excel to mitigate this vulnerability. Keep an eye on security bulletins from Microsoft for any additional patches or guidance. Be sure to review your security policies to prevent unauthorized access to sensitive information. You've got this! Follow these steps, and you'll have your Excel environment locked down tighter than ever! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00520 · 43.3th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2025-11-11T23:15Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/365_appsall versions—
microsoft/excelall versions—
microsoft/excelall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_online_server< 16.0.10417.2006816.0.10417.20068
References (1)
EPSS history
Timeline
  • 11 NOV 17:59Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5