CVE-2025-62563CWE-416

CVE-2025-62563

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
48.7
In the wild
Unconfirmed
What it is

⚡ A nefarious twist lurks within Microsoft Excel! A use-after-free vulnerability lets unauthorized attackers execute code locally, which could turn your spreadsheets into a hacker's playground! Think of it like a chef leaving a pot on the stove unattended — if nobody's watching, a sneaky wannabe chef could slip in and add their own ingredients without anyone noticing, ruining the whole dish! If exploited, this vulnerability could allow an attacker to execute arbitrary code on your machine, leading to unauthorized access, data breaches, or even full control of your system. This could be absolutely devastating in both personal and corporate environments, putting sensitive information at risk!

Put simply

Think of it like a chef leaving a pot on the stove unattended — if nobody's watching, a sneaky wannabe chef could slip in and add their own ingredients without anyone noticing, ruining the whole dish! This use-after-free vulnerability arises when Excel fails to properly manage memory, allowing attackers to manipulate program execution by sending malicious inputs. Essentially, it’s like leaving a window open for unwanted guests to sneak in.

What to do

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your machine, leading to unauthorized access, data breaches, or even full control of your system. This could be absolutely devastating in both personal and corporate environments, putting sensitive information at risk! To protect yourself, make sure to update Microsoft Excel to the latest version that addresses this vulnerability. Additionally, consider implementing stricter controls over your Excel files and scrutinize any macros or external content before opening it. Regular audits of your software can further reduce risk! You've got this! Follow these steps, and you'll keep your Excel environment secure and your data safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00614 · 48.7th percentile
Weakness
CWE-416 · Use After Free
Published
2025-12-09T23:16Z
Affected products (13)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/365_appsall versions—
microsoft/excelall versions—
microsoft/excelall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_long_term_servicing_channelall versions—
microsoft/office_online_server< 16.0.10417.2007516.0.10417.20075
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Microsoft Excel Remote Code Execution Vulnerability
    cvelistv5