What is the CVSS score of CVE-2025-59234?

CVE-2025-59234 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by CVE-2025-59234?

Microsoft Office (365 Apps Enterprise, 2016/2019, and LTSC 2021) deployments across Windows, macOS, and Android face elevated exploitation risk from document-based attacks with no remediation…

How to fix or mitigate CVE-2025-59234?

24 hours: Issue user guidance to restrict document opening from untrusted sources and disable macro execution where feasible; enable endpoint detection/response monitoring for suspicious Office child processes and memory manipulation. 7 days: Inventory vulnerable Office versions across Windows, macOS, and Android endpoints to quantify organizational exposure. 30 days: Monitor Microsoft Security Update Guide for patch release; deploy immediately to all affected Office versions (365 Apps Enterprise, 2016, 2019, LTSC 2021) upon availability.

Microsoft Office CVE-2025-59234

HIGH

Use After Free (CWE-416)

2025-10-14 secure@microsoft.com

Memory Corruption Microsoft Denial Of Service Use After Free 365 Apps Office Office Long Term Servicing Channel

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 16:30 vuln.today

DescriptionCVE.org

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office (including 365 Apps Enterprise, Office 2016/2019, and Office LTSC 2021 across Windows, macOS, and Android) is possible when a victim opens a maliciously crafted document that triggers a use-after-free condition. An unauthorized attacker who convinces a user to open the file can execute arbitrary code in the context of the current user, with no public exploit identified at time of analysis. CVSS is 7.8 reflecting local attack vector with required user interaction but full confidentiality, integrity, and availability impact.

Technical ContextAI

The flaw is a CWE-416 Use After Free memory corruption bug within Microsoft Office's document or object handling code. Use-after-free occurs when memory is referenced after it has been deallocated, allowing an attacker who controls heap allocation patterns to place attacker-controlled data into the freed region and hijack a subsequent dereference - typically a virtual function table pointer - to redirect execution. CPE data confirms the affected technologies span the Click-to-Run Microsoft 365 Apps (Enterprise x86/x64), the MSI-based Office 2016 and 2019 product families, and the Office Long Term Servicing Channel 2021 builds on Windows (x86/x64) and macOS, plus Office for Android, indicating the vulnerable parsing code is in a shared Office component rather than a single platform-specific binary.

RemediationAI

Apply the Microsoft security updates referenced in MSRC advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59234 - for Click-to-Run Microsoft 365 Apps this is delivered automatically through the Office update channel, while Office 2016, 2019, and LTSC 2021 require the corresponding Patch Tuesday MSI/MSP updates and the macOS and Android builds require updates from the Mac AutoUpdate service and Google Play respectively; exact patched build numbers are listed only in the MSRC update guide and should be cited from there rather than inferred. As compensating controls while patching, enable Protected View and Office Application Guard for documents originating from the Internet or email so untrusted files open in a sandboxed renderer, enforce Attack Surface Reduction rules that block child-process creation by Office applications and block executable content from email/webmail, and disable inbound delivery of legacy or unexpected Office formats via mail gateway policy - the trade-off is that Protected View and ASR rules can break legitimate document workflows (macros, embedded objects, automation) and need exception handling for power users.