Microsoft Office CVE-2025-59227

Exploitation requires the victim to open or preview a maliciously crafted Office document in a vulnerable build of Microsoft Office (365 Apps Enterprise, Office 2016/2019, or Office LTSC 2021 on Windows x86/x64 or macOS, or Office on Android); no prior authentication to the target machine and no elevated privileges are required (PR:N), but User Interaction is Required (UI:R) and the attack vector is Local (AV:L), meaning the payload must be processed locally by Office rather than delivered over a network service. Practical limiters: Protected View, Office Application Guard, Mark-of-the-Web enforcement, and ASR rules that block Office from spawning child processes all materially reduce the realistic exploit chain even though they do not stop the in-process UAF itself; Android exploitation is constrained by the platform sandbox.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High) and accurately reflects a client-side document-handling bug: the attack vector is Local because the malicious payload must be processed by Office on the victim host, and User Interaction is Required (the user must open or preview the file), but no prior authentication or privileges are needed on the target and all three CIA impacts are High. There is no EPSS score, SSVC decision, or KEV listing provided, and no POC is referenced, so realistic risk today is moderate-to-high: Office UAFs are historically attractive to phishing and targeted-intrusion operators, but absent observed in-the-wild use this is a patch-on-normal-cadence issue rather than an emergency. One signal to verify: the vector specifies AV:L while the description says 'unauthorized attacker' - this is consistent with the standard Microsoft convention of treating document-borne exploitation as Local with UI:R, not a contradiction, but defenders should not mistake AV:L for 'requires shell access.'

An attacker emails a crafted Office document (or hosts it on a website or file share) and lures a targeted user into opening it; when Office parses the malicious structure, the use-after-free is triggered and the dangling pointer is reclaimed with attacker-controlled data, yielding arbitrary code execution as the logged-in user. From that foothold the attacker can deploy a loader, harvest credentials and tokens, and pivot into corporate resources. No public exploit identified at time of analysis, but UAF bugs in Office historically become reliable once a crafted file format trigger is published.