EUVD-2025-17734Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). An attacker with local access can trigger the vulnerability through user interaction (opening a malicious file) to execute arbitrary code with the privileges of the Excel process, potentially achieving full system compromise. No KEV status, active exploitation data, or public POC availability was confirmed in the provided dataset, but the high CVSS score and local attack vector indicate this requires prompt patching.
Technical ContextAI
The vulnerability exists in Microsoft Office Excel's memory management subsystem, specifically classified as CWE-416 (Use After Free). This memory safety flaw occurs when Excel processes crafted file content that causes the application to reference memory that has been previously freed, allowing an attacker to corrupt heap state or inject malicious code. The vulnerability likely resides in Excel's parsing or rendering engine when handling specific cell objects, formulas, or embedded content. The local attack vector (AV:L) indicates the attacker must have file system or direct system access to deliver the malicious Excel file. Affected products include Microsoft Office Excel across multiple versions (exact version ranges would be specified in CVE-2025-47165 vendor advisories from Microsoft).
RemediationAI
Immediate: (1) Apply Microsoft security patches when released (monitor Microsoft Security Response Center); (2) Temporary workaround—disable Excel macros and restrict file opening from untrusted sources; restrict file type associations if possible. Medium-term: (1) Update to patched Excel versions via Windows Update or Office Update; (2) Deploy detection rules via endpoint protection to monitor for suspicious Excel process behavior; (3) Implement file content filtering/scanning for suspicious Excel files at network ingress. For enterprise: Use Group Policy to restrict Excel file execution context and block untrusted locations. Specific patch versions and KB numbers should be obtained from Microsoft's official security advisory for CVE-2025-47165.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today