CVE-2025-62557CWE-416

CVE-2025-62557

High ยท published December 9, 2025

CVSS v3.1
8.4
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

โšก A seemingly innocent document could be your worst nightmare! A use-after-free vulnerability in Microsoft Office allows attackers to execute code locally, like a guest sneaking into your house while you're distracted. ๐Ÿ”ฅ Think of it like a restaurant where a server forgets to remove a plate from a table, leaving an open spot for anyone to take whatever they want. In this case, it's your computer that's left vulnerable, allowing attackers to access critical data or execute harmful code without proper authorization. The consequences of this vulnerability are serious! An unauthorized attacker could gain full control over your system, potentially leading to data breaches, loss of sensitive information, or even installing malware that could wreak havoc. It's a recipe for disaster if not addressed!

Put simply

Think of it like a restaurant where a server forgets to remove a plate from a table, leaving an open spot for anyone to take whatever they want. In this case, it's your computer that's left vulnerable, allowing attackers to access critical data or execute harmful code without proper authorization. This use-after-free vulnerability occurs when Microsoft Office fails to properly manage memory, allowing an attacker to exploit the system and execute arbitrary code locally when a crafted document is opened.

What to do

The consequences of this vulnerability are serious! An unauthorized attacker could gain full control over your system, potentially leading to data breaches, loss of sensitive information, or even installing malware that could wreak havoc. It's a recipe for disaster if not addressed! To mitigate this risk, make sure to update Microsoft Office to the latest version immediately. Regularly check for updates and apply patches to keep your software secure. Educate users to be cautious about opening documents from untrusted sources. You've got this! By following these steps, you'll secure your system and become a security hero! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
8.4 ยท HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00425 ยท 35.7th percentile
Weakness
CWE-416 ยท Use After Free
Published
2025-12-09T23:16Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versionsโ€”
microsoft/365_appsall versionsโ€”
microsoft/365_copilotall versionsโ€”
microsoft/officeall versionsโ€”
microsoft/officeall versionsโ€”
microsoft/officeall versionsโ€”
microsoft/officeall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
microsoft/office_long_term_servicing_channelall versionsโ€”
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Microsoft Office Remote Code Execution Vulnerability
    cvelistv5