Microsoft Excel CVE-2025-59231

Exploitation requires the victim to open a specially crafted Excel workbook (UI:R) on the local system (AV:L); it cannot be triggered remotely without this user action, so no server-side or network-facing exposure exists. No prior authentication or privileges on the target are required (PR:N), but the dependence on a user opening attacker-supplied content via phishing or file sharing is the primary limiting factor. The flaw affects default installations of the listed Office/Excel/365 Apps and LTSC versions - no special non-default feature or configuration is indicated in the description - so any environment where users open untrusted spreadsheets is at risk. Code executes only in the context of the invoking user, not with elevated privileges.

This is a credible but not emergency-level priority. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a client-side memory-corruption flaw: the local attack vector combined with required user interaction means an attacker cannot reach this over the network directly - a victim must open a malicious Excel file. PR:N indicates no prior authentication is needed on the target, but UI:R is the key limiting factor. The EPSS score is low at 0.53% (44th percentile), indicating no measurable mass-exploitation activity. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is not confirmed to be actively exploited. CWE-843 type confusion in Office parsers is historically a favored target for weaponization and phishing-delivered attacks, and the signals are internally consistent (low EPSS, no KEV, no POC all align - no contradictions). Note the input Tags list 'Authentication Bypass', which does not match a CWE-843 type-confusion code-execution flaw - treat that label as suspect. Overall: a routine-to-elevated Patch Tuesday client bug warranting prompt patching in Office fleets, but not a drop-everything scenario absent evidence of in-the-wild use.

An attacker crafts a malicious Excel workbook that triggers a type-confusion condition in Excel's parsing logic and delivers it to a target via phishing email, a shared drive, or a download link. When the victim opens the file, the memory corruption is triggered and arbitrary code executes in the context of the user running Excel. No public proof-of-concept exploit has been identified at time of analysis, and the local vector plus required user interaction means social engineering is the practical delivery method.