Microsoft Excel CVE-2025-59224

Exploitation requires a user to open or preview an attacker-supplied malicious Excel workbook in an affected build of Microsoft Excel / Microsoft 365 Apps / Office 2019 / Office LTSC 2021/2024 (per CPE); there is no network-facing or unattended trigger. The key limiting factor is the mandatory user interaction (UI:R) - the victim must open the crafted file - and the attacker gains only the privileges of that user (S:U, no privilege escalation). Protected View / Office hardening and disabling automatic file opening reduce realistic exploitability. No special non-default product feature or configuration is called out in the description; it is a flaw in Excel's core file-handling code.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H, base 7.8) describes a classic client-side Office vulnerability: the 'local' attack vector combined with UI:R means code executes only after a victim opens a malicious Excel file, not via remote network access. Note the apparent tension between PR:N ('unauthorized attacker') and the practical reality that the attacker depends entirely on social engineering a user into opening a crafted document - PR:N is technically correct (no attacker-side authentication) but UI:R is the real gating factor. Exploitation signals are modest: EPSS is 0.38% (30th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified in the provided data. There is therefore no evidence of active exploitation; this is a high-severity-by-impact issue (reliable UAF RCE in ubiquitous software) rather than a currently-weaponized one. Given Excel's enormous deployment footprint and Office's history of becoming exploited via phishing, it warrants prompt patching, but the low EPSS and absence of KEV/POC argue against treating it as a drop-everything crisis today.

An attacker crafts a malicious Excel spreadsheet that triggers a use-after-free condition in Excel's parsing/object-handling code and delivers it via phishing email or a download link. When the victim opens the file (UI:R), the freed-memory reuse is manipulated to achieve arbitrary code execution in the context of the logged-in user. No public proof-of-concept was identified at time of analysis, so exploitation would currently require independent development of a reliable UAF primitive.