Microsoft Office CVE-2025-59234

Exploitation requires the victim to open an attacker-supplied Office document with a vulnerable build of Microsoft 365 Apps, Office 2016/2019, or Office LTSC 2021 on Windows, macOS, or Android - user interaction is mandatory per UI:R in the CVSS vector. No authentication to any service is required (PR:N) and no special non-default Office configuration is called out in the description, but Protected View, Application Guard, and ASR rules will block or contain the attack and so a successful exploit additionally requires that the document be opened outside Protected View (e.g., from a Trusted Location, after the user clicks Enable Editing, or via a file path that bypasses Mark-of-the-Web). The attack vector is local (AV:L) in the CVSS sense - code must run inside the Office process on the victim host - which limits worm-style propagation, but documents are trivially delivered via email, chat, and web download.

The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates local attack vector with required user interaction but no privileges, yielding a 7.8 High score driven by full CIA impact. This is the standard 'open a malicious document' profile - local because the file must be processed by Office on the victim host, but realistically deliverable via email, web download, or shared storage, so practical reachability is broader than 'local' suggests. EPSS, KEV status, and SSVC decision data were not provided in the input, so exploitation probability cannot be quantified; there is no public exploit identified at time of analysis and the bug is not listed in CISA KEV based on available data. Office document-handling use-after-frees are historically attractive targets for phishing-driven initial access and commodity malware loaders, so even without confirmed in-the-wild activity this should be treated as a high-priority patch for any environment that opens external documents.

An attacker emails a weaponized Office document (Word, Excel, or similar) to a target user, who opens it on a vulnerable Office build - possibly after dismissing Protected View. Parsing the malicious content triggers the use-after-free, the attacker reclaims the freed object with controlled data, and code executes in the security context of the user, enabling persistence, credential theft, or hands-on-keyboard follow-up. No public exploit is identified at time of analysis, but Office use-after-frees are a well-trodden phishing pattern.