EUVD-2025-17734CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). An attacker with local access can trigger the vulnerability through user interaction (opening a malicious file) to execute arbitrary code with the privileges of the Excel process, potentially achieving full system compromise. No KEV status, active exploitation data, or public POC availability was confirmed in the provided dataset, but the high CVSS score and local attack vector indicate this requires prompt patching.
Technical ContextAI
The vulnerability exists in Microsoft Office Excel's memory management subsystem, specifically classified as CWE-416 (Use After Free). This memory safety flaw occurs when Excel processes crafted file content that causes the application to reference memory that has been previously freed, allowing an attacker to corrupt heap state or inject malicious code. The vulnerability likely resides in Excel's parsing or rendering engine when handling specific cell objects, formulas, or embedded content. The local attack vector (AV:L) indicates the attacker must have file system or direct system access to deliver the malicious Excel file. Affected products include Microsoft Office Excel across multiple versions (exact version ranges would be specified in CVE-2025-47165 vendor advisories from Microsoft).
RemediationAI
Immediate: (1) Apply Microsoft security patches when released (monitor Microsoft Security Response Center); (2) Temporary workaround—disable Excel macros and restrict file opening from untrusted sources; restrict file type associations if possible. Medium-term: (1) Update to patched Excel versions via Windows Update or Office Update; (2) Deploy detection rules via endpoint protection to monitor for suspicious Excel process behavior; (3) Implement file content filtering/scanning for suspicious Excel files at network ingress. For enterprise: Use Group Policy to restrict Excel file execution context and block untrusted locations. Specific patch versions and KB numbers should be obtained from Microsoft's official security advisory for CVE-2025-47165.
More from same product – last 7 days
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Share
External POC / Exploit Code
Leaving vuln.today