What is the CVSS score of CVE-2025-62557?

CVE-2025-62557 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by CVE-2025-62557?

Microsoft Office products (365 Apps, 2016/2019, LTSC 2021) across Windows, macOS, and Android are vulnerable to arbitrary code execution when users open crafted documents.

How to fix or mitigate CVE-2025-62557?

Within 24 hours: Notify users to avoid opening Office documents from untrusted sources; inventory Office deployments by version and platform. Within 7 days: Disable macros by default in Office via GPO (Windows) and configuration profiles (macOS/iOS); deploy endpoint detection to flag suspicious Office process execution. Within 30 days: Monitor Microsoft Security Updates and CVE advisories for patch release; validate patch compatibility with Line of Business applications; pre-stage deployment for immediate rollout when Microsoft releases the fix.

Microsoft Office CVE-2025-62557

HIGH

Use After Free (CWE-416)

2025-12-09 secure@microsoft.com

Memory Corruption Microsoft Denial Of Service Use After Free 365 Apps Office Office Long Term Servicing Channel

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 16:31 vuln.today

DescriptionCVE.org

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office (365 Apps, Office 2016/2019, and Office LTSC 2021 across Windows, macOS, and Android) stems from a use-after-free memory corruption flaw tracked as CVE-2025-62557. An attacker who entices a user to open a crafted document can achieve arbitrary code execution with the privileges of the current user, with no public exploit identified at time of analysis. The CVSS 8.4 rating reflects high impact across confidentiality, integrity, and availability despite the local attack vector.

Technical ContextAI

The vulnerability is a CWE-416 use-after-free condition in Microsoft Office's document parsing or object handling code, where memory is referenced after it has already been freed. Such flaws typically arise when an object's lifetime is mismanaged during complex document rendering (e.g., embedded objects, OLE handling, or specific file format parsers), allowing an attacker to control the freed memory region and hijack execution flow. The CPE data confirms a broad footprint spanning Microsoft 365 Apps Enterprise (x64/x86), Office 2016 and 2019 (x64/x86), Office LTSC 2021 (x64/x86 and macOS), and Office for Android - indicating the vulnerable code path is in cross-platform Office shared components rather than a Windows-specific subsystem.

RemediationAI

Apply the Microsoft security updates referenced in MSRC advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62557 for each affected Office channel - Microsoft 365 Apps updates ship via Click-to-Run, while Office 2016/2019 and LTSC 2021 receive MSI/standalone patches through Microsoft Update or the Download Center, and the macOS LTSC and Android builds update through their respective platform mechanisms; exact patched build numbers are not enumerated in the available data and must be taken from the MSRC entry. Until patches are deployed across all SKUs, compensating controls include disabling the Outlook/Explorer Preview Pane to prevent auto-rendering of untrusted attachments (trade-off: reduced triage efficiency for users), enforcing Protected View and Office File Block policies for documents originating from the internet or email (trade-off: friction for legitimate inbound documents), and using Attack Surface Reduction rules to block Office applications from creating child processes (trade-off: may break legitimate macro-based workflows). No vendor-released patch version is independently confirmed from the supplied data beyond the MSRC advisory reference.