Microsoft Excel CVE-2025-59225

Exploitation requires a user to open a specially crafted Excel file (UI:R) on a local system (AV:L); there is no remote or network-triggered path. The use-after-free is reached through Excel's document parsing/memory handling, so the attacker needs only to deliver the file - no prior authentication or elevated privileges on the target are required (PR:N). Limiting factors: the mandatory user interaction (opening/previewing the malicious workbook), execution confined to the opening user's privilege context (S:U), and reliance on social engineering for delivery. Affected configurations are default installations of Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021/2024 (including macOS LTSC builds).

This is a genuine patch-priority item but not an emergency. The CVSS 3.1 base score of 7.8 is driven by HIGH impact to confidentiality, integrity, and availability (C:H/I:H/A:H) combined with low attack complexity (AC:L), but the vector is explicitly LOCAL (AV:L) and requires user interaction (UI:R) - meaning a victim must open a malicious Excel file, not a remote network-triggered compromise. The real-world exploitation signals temper the raw score: EPSS is only 0.38% (30th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data, so this is not confirmed actively exploited. The PR:N (unauthenticated) metric is somewhat misleading in isolation because exploitation still hinges entirely on social-engineering a user into opening a crafted document - the UI:R requirement is the primary limiting factor. Note a tag/impact tension: the input Tags include 'Denial Of Service,' yet the description and CVSS both describe code execution with full CIA impact; treat the primary risk as arbitrary code execution. Overall: patch in normal cycle, prioritize for high-value users susceptible to phishing, but no indication of widespread or automated exploitation.

An attacker crafts a malicious Excel spreadsheet that triggers a use-after-free in Excel's memory handling and delivers it via phishing email or a shared file. When the victim opens the document, the freed-then-reused memory is manipulated to execute attacker-controlled code in the context of the user. No public proof-of-concept exploit was identified at time of analysis, and the local vector with required user interaction means exploitation depends on successful social engineering.