CVE-2025-62559CWE-416

Microsoft Word Remote Code Execution Vulnerability

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
50.0
In the wild
Unconfirmed
What it is

⚡ A sneaky use-after-free vulnerability in Microsoft Office Word could let an unauthorized attacker run code on your machine! Think of it like a restaurant that mistakenly allows a customer to keep returning to a table they just vacated. That empty seat could lead to someone else sitting down and placing an order in your name! If exploited, this vulnerability could give attackers the ability to execute arbitrary code locally — allowing them to install malware, steal sensitive information, or even take complete control of your system. It's a significant risk that could lead to a cascade of security breaches if not addressed quickly.

Put simply

Think of it like a restaurant that mistakenly allows a customer to keep returning to a table they just vacated. That empty seat could lead to someone else sitting down and placing an order in your name! This use-after-free vulnerability occurs when Microsoft Word fails to correctly manage memory, allowing an attacker to manipulate the program's state and execute their code. Essentially, it's a memory management flaw that can be exploited inappropriately.

What to do

If exploited, this vulnerability could give attackers the ability to execute arbitrary code locally — allowing them to install malware, steal sensitive information, or even take complete control of your system. It's a significant risk that could lead to a cascade of security breaches if not addressed quickly. To protect your systems, ensure you're running the latest version of Microsoft Office Word. Regularly check for and apply security updates released by Microsoft. Additionally, consider enabling enhanced protection features within Word to mitigate potential threats. You've got this! Stay vigilant, follow these steps, and you'll keep your systems safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00637 · 50.0th percentile
Weakness
CWE-416 · Use After Free
Published
2025-12-09T17:55Z
EPSS history
Timeline
  • 09 DEC 17:55Z
    Microsoft Word Remote Code Execution Vulnerability
    cvelistv5