CVE-2025-62561CWE-822

CVE-2025-62561

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

⚡ An untrusted pointer dereference in Microsoft Office Excel could let an unauthorized attacker execute local code — talk about a surprise party no one wants! 🎉 Think of it like a waiter serving a dish without checking for dietary restrictions—if they don't verify what's on the plate, anyone can get served something harmful. In this case, Excel might run malicious code without realizing it! An attacker could potentially take over the system, executing any code they desire—everything from data theft to complete system compromise is on the table. That's a nightmare scenario for anyone relying on Excel for sensitive tasks!

Put simply

Think of it like a waiter serving a dish without checking for dietary restrictions—if they don't verify what's on the plate, anyone can get served something harmful. In this case, Excel might run malicious code without realizing it! The vulnerability arises when Excel processes pointers that haven’t been properly validated, allowing attackers to manipulate program flow and execute arbitrary code on the user's machine.

What to do

An attacker could potentially take over the system, executing any code they desire—everything from data theft to complete system compromise is on the table. That's a nightmare scenario for anyone relying on Excel for sensitive tasks! Update Microsoft Excel to the latest version immediately to patch this vulnerability. Ensure that you enable security updates and review all user permissions to minimize exposure to unauthorized access. 🛡️ You've got this! By taking these steps, you can fortify your defenses and keep your data safe! 🔒

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00521 · 43.3th percentile
Weakness
CWE-822 · Untrusted Pointer Dereference
Published
2025-12-09T23:16Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/365_appsall versions—
microsoft/excelall versions—
microsoft/excelall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_online_server< 16.0.10417.2007516.0.10417.20075
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5