What is the CVSS score of CVE-2025-62552?

CVE-2025-62552 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Microsoft Office Access are affected by CVE-2025-62552?

Microsoft Office Access users across supported 2016, 2019, LTSC 2021/2024, and Microsoft 365 Apps for enterprise deployments face a user-triggered local code-execution risk from CVE-2025-62552.

How to fix or mitigate CVE-2025-62552?

Within 24 hours, inventory all endpoints and users running Microsoft Office Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, or Microsoft 365 Apps for enterprise, confirm where Access is actually used, and issue a user advisory not to open untrusted Access database files from email, downloads, or removable media; enforce Protected View and Mark of the Web for Office documents and consider temporarily blocking .accdb, .mdb, and related Access file extensions at email and web gateways. Within 7 days, apply application control or Attack Surface Reduction rules to limit Access execution to approved business paths and users, enable enhanced endpoint detection and logging for Access child processes and suspicious file writes, and validate that backups and least-privilege controls reduce the impact of code execution in a user context. Within 30 days, re-check the vendor advisory for a fix for CVE-2025-62552, test and deploy any vendor-released patch as soon as available, evaluate removing Access from systems that do not require it, and conduct targeted user awareness training on opening untrusted documents.

Microsoft Office Access CVE-2025-62552

HIGH

Relative Path Traversal (CWE-23)

2025-12-09 secure@microsoft.com

Path Traversal Microsoft 365 Apps Office Office Long Term Servicing Channel Access

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-open vector with required victim interaction and no attacker privileges; successful open yields arbitrary code execution in the user context, giving full C/I/A within that scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 30, 2026 - 21:20 vuln.today

CVE Published

Dec 09, 2025 - 18:16 cve.org

HIGH 7.8

DescriptionCVE.org

Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally.

AnalysisAI

Relative path traversal in Microsoft Office Access (2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for enterprise) allows an unauthenticated local attacker to execute arbitrary code in the context of the user who opens a crafted file. The flaw requires user interaction to open a malicious document, and the attacker must first deliver the file and convince the victim to open it; it cannot be triggered remotely over a network. EPSS is 0.60% (46th percentile), and no public exploit identified at time of analysis; the independent assessment rates this as a moderate-priority local code-execution flaw, not an urgent internet-facing threat.

Technical ContextAI

The vulnerability is a CWE-23 relative path traversal in Microsoft Office Access, a database management system included in Microsoft 365 Apps and perpetual Office editions. Path traversal occurs when the application fails to properly sanitize user-controlled path input-such as sequences like '../'-allowing an attacker to escape an intended directory and reference or execute files outside the restricted location. Here, a specially crafted Access file can cause the application to resolve a relative path that leads to arbitrary code execution under the opening user's security context. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms local attack vector, low complexity, no privileges required, and mandatory user interaction; scope is unchanged, meaning no privilege escalation occurs. Affected editions per CPE include Microsoft 365 Apps for enterprise (x64/x86), Microsoft Access 2016, Microsoft Office 2019 (x64/x86), and Microsoft Office LTSC 2021 and 2024 (x64/x86).

RemediationAI

Apply the security updates provided by Microsoft for CVE-2025-62552; the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62552 lists the specific patches for each affected version (patch available per vendor advisory). Since the attack requires a user to open a malicious file, enforce Protected View for documents originating from the internet, keep Mark-of-the-Web warnings enabled, and train users to treat unsolicited Office files with caution. Blocking Access file extensions (.accdb, .accde, .accdr, etc.) at email gateways and web proxies can reduce delivery but may disrupt legitimate workflows; application allowlisting to restrict unexpected child processes from Access is an additional compensating control. With no public exploit identified at time of analysis, emergency mitigations are not required, but standard patching and user-awareness controls should be prioritized.