Microsoft Excel CVE-2025-59236

Exploitation requires a victim to open a specially crafted Excel workbook on a system running an affected build of Microsoft Office/365 Apps, Office 2019, or Office LTSC 2021/2024 (including macOS LTSC per the CPE list). The attack vector is local (AV:L): the malicious file must reach and be opened on the target machine, so delivery depends on social engineering (phishing, shared file, download). Code executes only in the context of the current user (scope unchanged), limiting direct impact absent further privilege escalation. The supplied vector lists UI:N, but realistically the file-open requirement acts as a user-interaction gate that limits mass/automated exploitation.

This is a moderate-priority local code-execution flaw rather than a drop-everything emergency. The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N, meaning Microsoft scored it as a local attack requiring low privileges but, notably, no user interaction. That UI:N is in tension with the description ('execute code locally') and the nature of an Excel use-after-free (CWE-416): such bugs are almost always triggered when a victim opens a malicious workbook, which would normally be modeled as UI:R - verify with the MSRC advisory before treating it as a no-interaction bug. EPSS is low at 0.42% (34th percentile), indicating a low modeled probability of exploitation in the near term. The CVE is NOT on CISA KEV and no POC or exploit code is referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Netting these signals: high technical impact (C:H/I:H/A:H) but local vector, dependence on tricking a user into opening a file, low EPSS, and no known exploitation make this a patch-in-normal-cycle item - real but not urgent - unless targeted/spear-phishing threat models apply.

An attacker crafts a malicious Excel workbook and delivers it via phishing email, a shared drive, or a download, relying on a user to open it locally. When Excel parses the file, a use-after-free condition is triggered, allowing the attacker to corrupt memory and execute arbitrary code in the context of the logged-in user. No public exploit code is referenced in the available data.