Microsoft Excel
CVE-2025-62553
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Excel file via phishing
-
DeliveryVictim opens workbook in Excel
-
ExploitTrigger use-after-free in Excel parser
-
ExecutionReuse freed object for control flow
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious Excel workbook on a vulnerable local installation of Microsoft Excel/Office (365 Apps, Excel 2016, Office 2019, or Office LTSC 2021/2024, including the macOS LTSC build) - this mandatory user interaction (UI:R) is the key limiting factor. No authentication or prior privileges are needed on the target (PR:N), but code executes only in the context of the user who opens the file. There is no remote/network-service exposure; the attacker depends on social engineering (phishing/attachment delivery) and on the target not having applied the Microsoft update. Protected View or opening untrusted files in a sandbox reduces real-world exploitability. |
| Impact | This is a genuine patch-priority item but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes the canonical Office document-handling flaw: the 'local' attack vector reflects that the malicious Excel file must be processed on the victim's machine, and UI:R confirms a user must open the crafted workbook - it is not a remotely-reachable service bug despite PR:N. The EPSS score of 0.66% (50th percentile) is modest, indicating no observed mass-exploitation signal. There is no CISA KEV listing and no public exploit was supplied in the input, so this is not confirmed to be under active exploitation. Signals are consistent rather than conflicting: a high-impact (C:H/I:H/A:H) client-side code-execution bug that requires user interaction, which is a well-understood phishing/malicious-attachment risk class rather than a wormable network exploit. Note the data set lacks an explicit patch version string (only the MSRC advisory URL is provided), and the 'Denial Of Service' tag conflicts with the code-execution impact in the description - treat the primary impact as remote code execution per the Use-After-Free (CWE-416) classification. |
| Exploit ScenarioDerived | An attacker crafts a malicious Excel workbook that triggers a use-after-free in Excel's parsing/object handling and delivers it via phishing email or a download link. When the victim opens the file, the freed-memory reuse is exploited to execute attacker-controlled code in the context of the user running Excel. No public exploit code was identified in the provided data, so this scenario is based on the CVE's CWE-416 classification and CVSS vector rather than an observed POC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Use-after-free memory corruption in Microsoft Excel allows code execution in the context of the user who opens a specially crafted Excel workbook on a vulnerable local installation. Affected builds span Microsoft 365 Apps for Enterprise (x86/x64), Excel 2016 (x86/x64), Office 2019 (x86/x64), and Office LTSC 2021 (x86/x64/macOS) and Office LTSC 2024 (x64), per the published CPE set. The vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) requires no prior credentials or privileges but does mandate user interaction - the victim must open the malicious file - so delivery depends on phishing or attachment-based social engineering rather than network exposure; no public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis, and EPSS is low at 0.66% (50th percentile).
RemediationAI
Microsoft has published fixes for this issue through the MSRC Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62553), so remediation is patch-based: patch status is "Patch available per vendor advisory" - apply the current Office security updates for each affected channel (Microsoft 365 Apps via the monthly Enterprise/Current Channel update, and Excel 2016, Office 2019, Office LTSC 2021 including macOS, and Office LTSC 2024 via Microsoft Update, Windows Update, or WSUS/Configuration Manager). No vendor-provided exact fixed build number is included in the supplied data, so verify the resolved build against the MSRC advisory before closing the finding. Because exploitation requires the user to open a malicious workbook, priority compensating controls are: enforce Protected View and mark files originating from the internet (Mark-of-the-Web) so downloaded spreadsheets open in the sandboxed, read-only Protected View, accepting the friction of extra prompts and occasional rendering limitations on trusted internal files; deploy the Office Attack Surface Reduction rules ("Block Office applications from creating child processes", "Block Office applications from creating executable content", "Block Win32 API calls from Office macros") to blunt post-exploitation chaining, with the trade-off that they can break legitimate macros, add-ins or automation and should be piloted; route inbound attachments through Defender for Office 365 Safe Attachments or an equivalent detonation sandbox to strip known malicious workbooks before delivery; and consider running Excel in Windows Defender Application Guard or a hardened container for high-risk users, at the cost of reduced functionality and more complex file-opening workflows. Patching remains the only complete fix - the mitigations above reduce but do not eliminate the use-after-free attack surface.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416) in Microsoft Excel's document parsing/rendering path, where an object in memory is released but subsequently dereferenced while processing a malformed workbook. This class of heap memory-corruption bug is a recurring Office file-format attack surface: the freed chunk can be reallocated with attacker-influenced data, letting the attacker corrupt adjacent structures and potentially redirect execution flow, which is why the assessed impact is high across confidentiality, integrity and availability (C:H/I:H/A:H). Per the supplied CPE inventory, the flaw is present in Microsoft 365 Apps for Enterprise (x86/x64), Excel 2016 (x86/x64), Office 2019 (x86/x64), Office LTSC 2021 (x86/x64 and macOS), and Office LTSC 2024 (x64) - i.e., a shared parsing component across the Office codebase rather than a single SKU. The vector AV:L with PR:N and UI:R means the attacker needs file delivery plus a user open action, but needs no local account or elevated rights; execution occurs under the opening user's token. Associated tags (Denial Of Service, Use After Free, Memory Corruption) are consistent with an attacker able to cause crashes as a minimum and arbitrary code execution under favorable heap conditions.
Know when Office gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user so AV:L and UI:R; no privileges needed (PR:N); use-after-free yields full code execution giving C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Executive ViewAI
Microsoft Excel users across the organization face a high-severity memory corruption vulnerability that could allow an attacker to execute code with the victim's privileges if they open a malicious workbook. This flaw affects all major Excel versions, including Microsoft 365 Apps, Office 2016, 2019, 2021, and 2024, and while no public exploit identified at time of analysis, the absence of a vendor fix means we must rely on layered defenses to protect sensitive data and maintain business continuity. Leadership should prioritize user awareness and technical mitigations to reduce the risk of a successful phishing attack that could lead to data theft or further network compromise.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing Protected View, disabling macros, blocking untrusted file types (e.g., .xls, .xlsx, .xlsm from external sources), enabling ASR rules, user education on phishing, and application allowlisting for Excel.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbit
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Offic
Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 201
Microsoft Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, and Lyn
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
GitHub PoC
Exploit-DB