CVE-2025-62554CWE-843

CVE-2025-62554

High · published December 9, 2025

CVSS v3.1
8.4
EPSS
0%
Percentile
36.7
In the wild
Unconfirmed
What it is

⚡ A sneaky type confusion in Microsoft Office could let an unauthorized attacker execute code locally—like getting into a restricted party by wearing a costume that blends in! 🎭 Think of it as someone dressing up as staff to access a private event—they might not belong there, but their convincing disguise opens the door. This vulnerability allows attackers to leverage incompatible resource types to bypass security measures in Microsoft Office. If exploited, an attacker could run their own code on a victim's machine, potentially leading to data breaches, unauthorized access to sensitive files, or even full control over the affected system. This could be absolutely devastating for your personal and organizational security!

Put simply

Think of it as someone dressing up as staff to access a private event—they might not belong there, but their convincing disguise opens the door. This vulnerability allows attackers to leverage incompatible resource types to bypass security measures in Microsoft Office. This type confusion vulnerability in Microsoft Office arises when the software mistakenly handles an incompatible resource type, allowing unauthorized code execution. This flaw can lead to significant security risks if injected code is executed.

What to do

If exploited, an attacker could run their own code on a victim's machine, potentially leading to data breaches, unauthorized access to sensitive files, or even full control over the affected system. This could be absolutely devastating for your personal and organizational security! To mitigate this vulnerability, ensure you are running the latest version of Microsoft Office with all security patches applied. Regularly check for updates and consider implementing application whitelisting to restrict unauthorized code execution. This is fixable! Stay updated and vigilant, and you'll keep your systems safe! 🛡️

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00434 · 36.7th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2025-12-09T23:16Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/365_appsall versions—
microsoft/365_copilotall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Microsoft Office Remote Code Execution Vulnerability
    cvelistv5