CVE-2025-62216CWE-416

CVE-2025-62216

High · published November 11, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

⚡ A sneaky use-after-free vulnerability in Microsoft Office can let an unauthorized attacker execute local code! 📂 Think of it like a restaurant that forgets to clear tables properly—an open seat could allow someone to slip in and take control of the kitchen, cooking whatever they want without anyone noticing! 🍽️ If exploited, an attacker could gain the ability to run any code on the system, potentially stealing sensitive information or even transforming the whole system into a malicious playground. The fallout could be absolutely devastating! 🔥

Put simply

Think of it like a restaurant that forgets to clear tables properly—an open seat could allow someone to slip in and take control of the kitchen, cooking whatever they want without anyone noticing! 🍽️ This vulnerability arises when Microsoft Office improperly handles memory, leading to a scenario where an attacker could manipulate memory after it has been freed. This exploit allows for arbitrary code execution, enabling unauthorized access to the system's resources.

What to do

If exploited, an attacker could gain the ability to run any code on the system, potentially stealing sensitive information or even transforming the whole system into a malicious playground. The fallout could be absolutely devastating! 🔥 To mitigate this vulnerability, ensure that all Microsoft Office installations are updated to the latest version, where this flaw has been addressed. Regularly review your security policies to prevent unauthorized access and monitor for any unusual activity! 🛡️ You've got this! Follow these steps, and you’ll be one step closer to fortifying your defenses! 💪✨

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00444 · 37.6th percentile
Weakness
CWE-416 · Use After Free
Published
2025-11-11T23:15Z
Affected products (6)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/365_appsall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
References (1)
EPSS history
Timeline
  • 11 NOV 17:59Z
    Microsoft Office Remote Code Execution Vulnerability
    cvelistv5