What is the CVSS score of CVE-2025-59227?

CVE-2025-59227 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by CVE-2025-59227?

Microsoft Office (including 365 Apps Enterprise, Office 2016/2019, and LTSC 2021) contains a code execution vulnerability that activates when employees open malicious documents, potentially…

How to fix or mitigate CVE-2025-59227?

Within 24 hours: conduct an inventory of Office deployments (365 Apps Enterprise, Office 2016, Office 2019, LTSC 2021 versions and build numbers) to establish baseline affected population; assess current EDR and email gateway filtering capabilities. Within 7 days: deploy compensating controls including user awareness training on document sourcing validation, configure Office application hardening via Group Policy (disable legacy features, restrict macro execution), and enable Advanced Threat Protection (ATP) for Office files if available in licensing tier. Within 30 days: establish tracking mechanism for MSRC advisory CVE-2025-59227 patch release; develop expedited deployment plan for patch distribution once vendor releases fix.

Microsoft Office CVE-2025-59227

HIGH

Use After Free (CWE-416)

2025-10-14 secure@microsoft.com

Memory Corruption Microsoft Denial Of Service Use After Free 365 Apps Office Office Long Term Servicing Channel

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 16:30 vuln.today

DescriptionCVE.org

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office (including Microsoft 365 Apps Enterprise, Office 2016/2019, and Office LTSC 2021 across Windows x86/x64, macOS, and Android) arises from a use-after-free memory corruption (CWE-416) that an attacker can trigger by convincing a user to open a crafted document. Exploitation runs in the context of the current user with high impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

The flaw is a CWE-416 use-after-free in the Microsoft Office suite - a class of memory corruption where code continues to reference heap memory after it has been freed, enabling an attacker to reclaim that allocation with controlled data and hijack execution flow when the dangling pointer is dereferenced. Office's document parsers (Word, Excel, PowerPoint, and shared rich-text/OLE components) historically reuse complex object models for parsing structured file formats, and lifetime bugs in those object graphs are a recurring source of UAF conditions. The CPE list shows the defect spans the entire current Office estate: Microsoft 365 Apps (Enterprise x86/x64), perpetual Office 2016 and 2019, and Office LTSC 2021 on Windows x86/x64 and macOS, plus Office on Android, indicating the vulnerable component is shared across platforms rather than being OS-specific.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59227 for each affected channel - Microsoft 365 Apps via Click-to-Run servicing, Office 2016/2019/LTSC 2021 via Microsoft Update or the corresponding MSP/MSI packages, and the Android build via the Play Store - using the exact fixed build listed in that advisory (specific fixed versions are not included in the input data, so consult MSRC for the exact KB/build per SKU). Until the patch is deployed, compensating controls include enabling Protected View and Office Application Guard for files originating from the internet or email so untrusted documents are parsed in a sandboxed container, blocking or quarantining Office attachments at the mail gateway from external senders, and enabling Microsoft Defender Attack Surface Reduction rules that block Office from creating child processes and from executing downloaded executable content - these reduce post-exploitation impact but do not address the underlying parser bug and can break legitimate macros, add-ins, or workflows that rely on child-process spawning.