CVE-2025-62203CWE-416

CVE-2025-62203

High Β· published November 11, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

⚑ A sneaky use-after-free vulnerability in Microsoft Excel could allow an unauthorized attacker to execute code on your system without breaking a sweat! πŸ’» Picture a restaurant that forgets to remove an order from the kitchen after it’s been served. That leftover order might get prepared again by mistake, serving it up to someone else! This vulnerability lets an attacker gain access to code that should have been freed up, just waiting to be exploited. If an attacker exploits this flaw, they could execute arbitrary code on your machine, potentially taking over your system, stealing sensitive data, or causing chaos. It's like handing over the restaurant keys to a stranger who can then decide the fate of your kitchen, and that's a recipe for disaster!

Put simply

Picture a restaurant that forgets to remove an order from the kitchen after it’s been served. That leftover order might get prepared again by mistake, serving it up to someone else! This vulnerability lets an attacker gain access to code that should have been freed up, just waiting to be exploited. This use-after-free vulnerability arises when Excel fails to properly manage memory, allowing an attacker to manipulate the execution flow and run malicious code when accessing freed or unallocated memory regions.

What to do

If an attacker exploits this flaw, they could execute arbitrary code on your machine, potentially taking over your system, stealing sensitive data, or causing chaos. It's like handing over the restaurant keys to a stranger who can then decide the fate of your kitchen, and that's a recipe for disaster! To safeguard your system, make sure to update Microsoft Excel to the latest version immediately. Regularly check for updates and apply security patches as they are released. Don't forget to review your security configurations and restrict access where possible! You've got this! Stay vigilant and patch up, and you'll keep your digital kitchen safe and sound! πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
7.8 Β· HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00548 Β· 45.1th percentile
Weakness
CWE-416 Β· Use After Free
Published
2025-11-11T23:15Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versionsβ€”
microsoft/365_appsall versionsβ€”
microsoft/excelall versionsβ€”
microsoft/excelall versionsβ€”
microsoft/officeall versionsβ€”
microsoft/officeall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_online_server< 16.0.10417.2006816.0.10417.20068
References (1)
EPSS history
Timeline
  • 11 NOV 17:59Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5