CVE-2025-62560CWE-126CWE-822

CVE-2025-62560

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
43.4
In the wild
Unconfirmed
What it is

⚡ An untrusted pointer dereference in Excel could let an unauthorized attacker run code locally! It’s like letting someone walk into your office and start typing away on your computer without any checks! 😱 Imagine you’re a chef in a bustling restaurant, and you have a special ingredient locker. If someone could just open it without your permission and swap out any ingredient, chaos would ensue! This vulnerability allows attackers to execute their code on your system without proper authorization. An attacker could exploit this flaw to execute arbitrary code on your machine. This means they could install malware, steal sensitive data, or take control of your system, leading to potentially devastating consequences! 😨

Put simply

Imagine you’re a chef in a bustling restaurant, and you have a special ingredient locker. If someone could just open it without your permission and swap out any ingredient, chaos would ensue! This vulnerability allows attackers to execute their code on your system without proper authorization. This vulnerability stems from Excel's mishandling of pointers, allowing unauthorized attackers to dereference untrusted pointers, which can lead to local code execution. Essentially, it’s a gap in the security that doesn’t properly validate inputs before processing them.

What to do

An attacker could exploit this flaw to execute arbitrary code on your machine. This means they could install malware, steal sensitive data, or take control of your system, leading to potentially devastating consequences! 😨 To protect yourself, ensure you update to the latest version of Microsoft Office Excel as soon as a patch is released. Meanwhile, avoid opening untrusted spreadsheets and consider implementing strict software permissions to mitigate risks. You've got this! Stay vigilant and keep your software updated, and you’ll secure your environment in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00521 · 43.4th percentile
Weaknesses
CWE-126 · Buffer Over-read; CWE-822 · Untrusted Pointer Dereference
Published
2025-12-09T23:16Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/365_appsall versions—
microsoft/excelall versions—
microsoft/excelall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_online_server< 16.0.10417.2007516.0.10417.20075
References (1)
EPSS history
Timeline
  • 09 DEC 17:56Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5