CVE-2025-62556CWE-822

CVE-2025-62556

High ยท published December 9, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

โšก An unauthorized attacker can execute code locally through a sneaky untrusted pointer dereference in Microsoft Office Excel! ๐ŸŽฏ Think of it like an office worker getting access to a confidential file just because they found a loose cable connecting to the server room โ€” they could cause all sorts of havoc without anyone noticing! This flaw puts your system at risk, allowing attackers to run malicious code as if they were right there in your office. If left unpatched, they could access sensitive data, install malware, or even take full control of your system, leading to chaos! ๐Ÿ”ฅ

Put simply

Think of it like an office worker getting access to a confidential file just because they found a loose cable connecting to the server room โ€” they could cause all sorts of havoc without anyone noticing! The untrusted pointer dereference in Microsoft Office Excel means that when Excel handles pointers incorrectly, attackers can exploit this flaw to execute arbitrary code locally, bypassing security protocols.

What to do

This flaw puts your system at risk, allowing attackers to run malicious code as if they were right there in your office. If left unpatched, they could access sensitive data, install malware, or even take full control of your system, leading to chaos! ๐Ÿ”ฅ To safeguard your systems, immediately update Microsoft Office Excel to the latest version where this vulnerability is patched. Additionally, ensure to conduct regular security assessments to catch such vulnerabilities before they can be exploited. ๐Ÿ›ก๏ธ You've got this! Stay proactive and secure your systems, and you'll be a security hero in no time! ๐Ÿš€

The record
Technical detail
CVSS v3.1
7.8 ยท HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00558 ยท 45.8th percentile
Weakness
CWE-822 ยท Untrusted Pointer Dereference
Published
2025-12-09T23:16Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versionsโ€”
microsoft/365_appsall versionsโ€”
microsoft/excelall versionsโ€”
microsoft/excelall versionsโ€”
microsoft/officeall versionsโ€”
microsoft/officeall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_online_server< 16.0.10417.2007516.0.10417.20075
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5