Microsoft Excel
CVE-2025-59223
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Excel workbook
-
DeliveryDeliver via phishing email
-
ExploitVictim opens file in Excel
-
ExecutionTrigger use-after-free in Excel
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires user interaction: the victim must open an attacker-supplied crafted Excel file on a system with an affected Office/Excel build (Microsoft 365 Apps, Excel 2016, Office 2019, or Office LTSC 2021/2024, per the CPE list). The vector is local (AV:L) - the attacker has no network path to Excel and depends entirely on social engineering to get the file opened; code runs only with the privileges of the opening user (no privilege escalation implied by S:U). This is not a wormable or unauthenticated-remote condition; the user-interaction requirement and local vector are the primary limiting factors that reduce real-world risk below the raw 7.8 score. There is no special non-default configuration required - default Excel file-handling is sufficient. |
| Impact | This is a genuine but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a classic Office client-side code-execution flaw: the attacker cannot reach Excel over the network and must get a victim to open a malicious file (AV:L + UI:R), but no prior authentication or privileges are needed (PR:N) and successful exploitation yields full confidentiality, integrity, and availability impact in the user's context. Supporting signals argue against treating this as actively dangerous right now: EPSS is only 0.38% (30th percentile), there is NO CISA KEV listing, and NO public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The signals are internally consistent (a local, user-interaction-dependent memory-corruption bug correctly carries a low exploitation probability), so there is no conflict to flag here. The practical caveat is historical: Office memory-corruption bugs (CWE-416 use-after-free) are a recurring target for phishing-delivered exploitation, so despite the low EPSS this class warrants prompt patching even though it is not a drop-everything issue. Only one reference (the Microsoft MSRC advisory) is provided, so affected-version detail beyond the CPE list is limited. |
| Exploit ScenarioDerived | An attacker emails or otherwise delivers a specially crafted Excel workbook to a target and lures them into opening it. On open, Excel mishandles a freed object (use-after-free), allowing the attacker's controlled data to drive execution and run arbitrary code with the privileges of the user who opened the file. No public exploit code is currently identified, so this requires the attacker to develop their own exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Code execution in Microsoft Excel 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps arises from a use-after-free condition (CWE-416) triggered when a user opens a crafted workbook. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker cannot reach Excel over the network and must rely on social engineering, but successful exploitation runs code with the victim user's privileges and can compromise confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, EPSS is low at 0.38% (30th percentile), and the local vector plus required user interaction make this a genuine but not emergency-tier priority.
RemediationAI
Apply the current Microsoft Office/Excel security update referenced by the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59223; the provided data does not specify an exact fixed build, so verify the patched version in Microsoft's advisory for each affected channel (Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024). Because exploitation requires the victim to open a crafted workbook, enforce Mark-of-the-Web and Protected View for files received from email or the internet, which reduces exposure but may block embedded objects, macros, or editing until users explicitly trust the file. Restrict Excel to trusted locations and quarantine unexpected .xls/.xlsx attachments, accepting the usability trade-off of additional prompts or blocked files. If update deployment is delayed, use application isolation or a sandbox for opening untrusted Excel documents; this limits code execution impact but can disrupt add-ins and workflows.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Microsoft Excel's workbook parsing and object handling logic is susceptible to a use-after-free (CWE-416): a memory object is freed while a pointer to it remains, and a crafted Excel document can manipulate object lifetime so that the dangling reference is reused. This class of memory-corruption bug can lead to arbitrary code execution in the context of the Excel process, and the source tags also note denial-of-service and memory-corruption impact. The supplied CPE inventory identifies Microsoft 365 Apps for Enterprise on x64 and x86, Microsoft Excel 2016 on x64 and x86, Microsoft Office 2019 on x64 and x86, Microsoft Office LTSC 2021 on x64, x86, and macOS, and Microsoft Office LTSC 2024 on x64. Per the independent assessment, no special non-default configuration is required; default Excel file handling is sufficient, and exploitation depends on the victim opening an attacker-supplied file.
Know when Office gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Victim must open a crafted file (AV:L, UI:R) with no prior auth (PR:N); reliable UAF trigger gives AC:L, and code execution in user context yields C/I/A:H with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Executive ViewAI
A high-severity use-after-free vulnerability in Microsoft Excel (CVE-2025-59223) allows code execution with the victim's privileges when a user opens a crafted workbook, affecting Excel 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps. Exploitation requires local access and user interaction, so the main business risk is targeted phishing or malicious document delivery rather than remote compromise. With no vendor patch available and no public exploit identified at time of analysis, leadership should focus on user awareness, email filtering, and endpoint controls to reduce exposure.
No vendor patch available. Enforce Protected View, block macros for untrusted Excel workbooks, filter external Office attachments, deploy Attack Surface Reduction rules to block Office child-process creation, and restrict opening documents from untrusted locations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbit
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Offic
Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 201
Microsoft Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, and Lyn
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
GitHub PoC
Exploit-DB