What is the CVSS score of CVE-2025-62554?

CVE-2025-62554 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by CVE-2025-62554?

Microsoft Office (365 Apps, 2016/2019, LTSC 2021, and mobile editions) contains an unauthenticated local code execution vulnerability triggered when users open malicious documents.

How to fix or mitigate CVE-2025-62554?

Within 24 hours: Issue security alert to all users warning against opening Office files from untrusted sources; audit document receipt pathways (email, file sharing, web downloads) for bottleneck enforcement points. Within 7 days: Deploy group policy updates to disable macros by default, enforce User Access Control (UAC) strict mode, and block unsigned Office add-ins. Within 30 days: Establish monitoring for Microsoft security advisories; develop and test patch deployment plan for all affected Office versions (365, 2016, 2019, LTSC 2021, and mobile) once vendor patch is released.

Microsoft Office CVE-2025-62554

HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2025-12-09 secure@microsoft.com

Memory Corruption Microsoft Authentication Bypass 365 Apps Office Office Long Term Servicing Channel

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 16:30 vuln.today

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office (365 Apps, Office 2016/2019, Office LTSC 2021, and Office for Android/macOS) stems from a type confusion flaw (CWE-843) that lets an attacker run arbitrary code in the context of the current user. Despite PR:N/UI:N in the CVSS vector, the AV:L attack vector means the attacker must deliver a malicious document to be opened on the target host. No public exploit has been identified at time of analysis and the CVE is not on the CISA KEV list.

Technical ContextAI

The root cause is CWE-843 (Access of Resource Using Incompatible Type - 'Type Confusion'), in which Office code casts an object to an incompatible type without proper validation, causing the program to interpret memory layout incorrectly. This commonly arises in Office's document parsers (Word, Excel, PowerPoint) when handling embedded objects, OLE structures, or scripting objects, and the resulting memory mismatch can be steered into a controlled write or vtable corruption that yields arbitrary code execution. The affected CPE set spans Microsoft 365 Apps (Enterprise x86/x64), Office 2016 and 2019 (x86/x64), Office LTSC 2021 (x86/x64 and macOS), and Office for Android, indicating the vulnerable component is in shared Office code rather than a single application.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62554 - patch available per vendor advisory; exact fix build numbers are channel-specific and listed in that advisory for 365 Apps, Office 2016, Office 2019, Office LTSC 2021 (Windows and macOS), and Office for Android. As compensating controls while patching, enable Protected View and Application Guard for Office so untrusted documents open in an isolated container (trade-off: macros and some embedded content are restricted), block Office documents originating from email or the internet via Attack Surface Reduction rule 'Block Office applications from creating executable content', and use Mark-of-the-Web enforcement so files from external sources are forced into Protected View. Where feasible, restrict opening of Office documents from untrusted senders via mail-gateway filtering of risky file types (trade-off: business users may need exception workflows).