Microsoft Excel CVE-2025-62560

Exploitation requires the victim to open a maliciously crafted Excel workbook in a vulnerable build of Microsoft Excel, Office 2019, 365 Apps, or Office LTSC 2021/2024 (including macOS for LTSC 2021) - the CVSS UI:R metric confirms user interaction is mandatory, and AV:L means the attacker cannot trigger this over the network without the user first opening the file. There are no special product-configuration prerequisites named in the description; the limiting factor is entirely the required user action of opening the file, which means delivery relies on social engineering (phishing, malicious download, shared document). Code executes only in the context of the user who opens the file, bounding impact to that user's privileges rather than granting a scope change (S:U).

This is a moderate-priority, not top-tier, issue despite its 7.8 (High) CVSS. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes local attack vector with low complexity, no privileges, but REQUIRED user interaction - the classic 'victim opens a malicious Excel file' pattern rather than a remotely-reachable network bug. The EPSS score of 0.52% (43rd percentile) is low-to-moderate, indicating no strong signal of imminent mass exploitation. The vulnerability is NOT listed in CISA KEV and there is no public exploit identified at time of analysis, so all three exploitation signals (EPSS, KEV, POC) are aligned toward low current real-world exploitation. The high impact (C:H/I:H/A:H = code execution in the user's context) is real, but exploitation is gated entirely by user interaction, which substantially lowers practical risk versus a zero-click or network-reachable flaw. Note one metadata inconsistency to verify: the assigned CWE-126 (Buffer Over-read) conflicts with the description's 'untrusted pointer dereference' (more consistent with CWE-822/CWE-476) and the 'Buffer Overflow' tag - the exact memory-safety mechanism should be confirmed with Microsoft's advisory. Net: patch on normal Patch Tuesday cadence; this is a widely-deployed product (Excel) so aggregate exposure is large, but no evidence of active or automatable exploitation elevates it to emergency status.

An attacker crafts a malicious Excel workbook that triggers an untrusted pointer dereference when parsed, then delivers it via phishing email, a shared drive, or a download link. When the victim opens the file in a vulnerable Excel/Office build, the flaw allows arbitrary code execution in the context of the current user. No public proof-of-concept exploit has been identified at time of analysis, and exploitation depends entirely on the victim opening the attacker-supplied file.