CVE-2025-62205CWE-416

CVE-2025-62205

High · published November 11, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

⚡ An unauthorized attacker can execute code locally in Microsoft Office Word due to a sneaky use-after-free vulnerability! 🦸‍♂️ It's like a construction crew that forgets to secure a scaffolding before starting work—once someone climbs up, they can access all sorts of sensitive areas without any proper oversight! This vulnerability could allow an attacker to gain control over a user's machine, potentially leaking sensitive information or even installing malicious software. Imagine the chaos if they suddenly had the ability to manipulate documents or compromise data without anyone knowing!

Put simply

It's like a construction crew that forgets to secure a scaffolding before starting work—once someone climbs up, they can access all sorts of sensitive areas without any proper oversight! This use-after-free flaw occurs in Microsoft Office Word, where memory that is still being referenced is freed too early, allowing an attacker to execute arbitrary code in the context of the user.

What to do

This vulnerability could allow an attacker to gain control over a user's machine, potentially leaking sensitive information or even installing malicious software. Imagine the chaos if they suddenly had the ability to manipulate documents or compromise data without anyone knowing! Update Microsoft Office Word to the latest version immediately to patch this vulnerability. Additionally, review your security settings and consider implementing more stringent access controls to limit potential exploits. Don't forget to educate users about potential phishing attempts that could lead to exploitation! You've got this! Follow these steps and tighten your security, and you'll keep those attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00444 · 37.6th percentile
Weakness
CWE-416 · Use After Free
Published
2025-11-11T23:15Z
Affected products (6)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/365_appsall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
References (1)
EPSS history
Timeline
  • 11 NOV 17:59Z
    Microsoft Office Remote Code Execution Vulnerability
    cvelistv5