Microsoft Excel
CVE-2025-59233
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Excel workbook
-
DeliveryDeliver via phishing or download
-
ExploitVictim opens crafted file
-
ExecutionTrigger type confusion corrupting memory
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open or preview a specially crafted Excel file (workbook/spreadsheet) in a vulnerable build of Microsoft Excel or Office (365 Apps, Excel 2016, Office 2019, Office LTSC 2021/2024, including macOS LTSC 2021). Per PR:N no authentication or prior privileges are needed, but the UI:R requirement means the attack cannot succeed without victim action - this user-interaction gate, combined with the local (file-delivery) attack vector rather than remote network reach, is the primary limiting factor; Protected View and disabled file-open from untrusted sources further reduce realistic exploitability. |
| Impact | This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is the canonical Microsoft Office client-side code-execution profile: 'local' attack vector because exploitation hinges on the victim opening a crafted file rather than remote network reach, no privileges required (PR:N), but mandatory user interaction (UI:R) and full C/I/A impact in the user's security context. The EPSS score is low (0.53%, 44th percentile), it is NOT on the CISA KEV list, and no public exploit is referenced - so there is no public exploit identified at time of analysis, and the signals are internally consistent rather than conflicting: a high-impact-but-interaction-gated memory-corruption bug with no evidence of in-the-wild activity. Note the input Tag 'Authentication Bypass' conflicts with the actual vulnerability class (CWE-843 type confusion / memory corruption) and should be disregarded - this is an RCE, not an auth bypass. Net: patch on a normal cadence; the combination of required user interaction and local-only vector keeps real-world urgency below what the 7.8 'High' score alone might suggest, though the ubiquity of Excel means a weaponized sample could scale quickly if one emerges. |
| Exploit ScenarioDerived | An attacker crafts a malicious Excel workbook that triggers the type-confusion flaw and delivers it via phishing email or a web download. When the victim opens the file in a vulnerable Excel build, the incompatible-type access corrupts memory and runs attacker-controlled code with the user's privileges. No public proof-of-concept is referenced, and the AV:L/UI:R vector means success depends entirely on convincing the user to open the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
A type-confusion memory-corruption flaw in Microsoft Excel lets an attacker execute arbitrary code at the privilege level of the logged-on user when a victim opens or previews a specially crafted workbook. No credentials or prior foothold are required (PR:N per the assessed vector), but the attack is local file-delivery and user-interaction gated (UI:R) - the victim must open or preview the malicious spreadsheet, which is the primary limiting factor; Protected View and File Block policies further reduce realistic exploitation. There is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS is low (0.53%, 44th percentile), making this a genuine but second-tier patching priority relative to internet-facing, no-interaction issues.
RemediationAI
Apply the Microsoft security update listed for CVE-2025-59233 in the MSRC Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59233): Microsoft 365 Apps and Office LTSC update through Click-to-Run/Windows Update (or Microsoft AutoUpdate on macOS - the LTSC 2021 for Mac CPE is explicitly affected, so Mac fleets must not be skipped), while Excel 2016 and Office 2019 require the corresponding MSI security update; no separate vendor workaround is published, so patching is the primary fix. If immediate patching is not possible, reduce exposure by enforcing Protected View for files originating from the internet and other unsafe locations and enabling File Block settings for untrusted formats - trade-off: users will see extra prompts and some legacy or externally sourced workbooks will fail to open, which should be communicated in advance. Additionally, disable the Outlook Reading Pane/attachment preview and mail-gateway auto-preview of Excel attachments so documents are not parsed before a user deliberately opens them, and apply the ASR rule 'Block Office applications from creating child processes' to blunt post-exploitation payload execution - trade-off: legitimate macro-driven workflows that spawn processes will break and should be tested against a pilot ring. Because the weak point is local file delivery plus user interaction, sandboxing or detonating untrusted spreadsheets in a disposable VM remains an effective compensating control until the update is deployed across all Office channels, including Office Online Server if it is used for document preview.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-843 (Access of Resource Using Incompatible Type, i.e. type confusion) in Microsoft Office Excel means the application misinterprets an object in memory as a different type than it actually is while parsing workbook content - a classic memory-corruption primitive in a C++-based document parser. The attacker crafts an Excel file whose internal structures are inconsistent with what the parser expects; once the object is used through the wrong type, the resulting out-of-bounds or unvalidated memory access can be shaped into controlled writes and ultimately arbitrary code execution inside the Excel process (winword/excel.exe on Windows, Excel on macOS). Because exploitation occurs during document open or preview, no macros need to be enabled and no user beyond opening the file is required - which is exactly why Office Protected View and File Block settings are the effective friction points. The CPE data covers the full consumer and enterprise Excel surface: Microsoft 365 Apps for Enterprise (x86/x64), Excel 2016 (x86/x64), Office 2019 (x86/x64), Office LTSC 2021 (x86/x64 and macOS), and Office LTSC 2024 (x64); the accompanying tags also point at Office Online Server, indicating the same parsing code is reachable through server-side document rendering/preview pipelines.
Know when Office gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open code execution: AV:L and UI:R because the victim must open a crafted file, PR:N since no prior auth is needed, full C/I/A impact in the user context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Executive ViewAI
Microsoft Excel carries a high-severity memory-corruption exposure that could allow a malicious workbook to run code with the rights of the user who opens or previews it, affecting staff who handle external or untrusted spreadsheets. There is no public exploit identified at time of analysis and exploitation requires user interaction, so near-term likelihood is constrained, but Excel's broad deployment and the lack of a vendor patch make configuration-based containment and user awareness the immediate leadership priorities.
No vendor-released patch identified at time of analysis. Enforce Protected View for untrusted workbooks, apply File Block policies for risky or externally sourced Excel formats, disable or restrict Office file preview handlers, and filter spreadsheet attachments at email and web gateways.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Affected Products (CPE)CVE.org
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbit
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Offic
Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 201
Microsoft Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, and Lyn
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
GitHub PoC
Exploit-DB