Microsoft Excel CVE-2025-62563

Exploitation requires the victim to open an attacker-supplied, specially crafted Excel workbook - the UI:R metric in the CVSS vector reflects this mandatory user interaction, which is the single biggest limiting factor. No authentication or elevated privileges are needed (PR:N), and code runs in the context of the user who opens the file, so impact is bounded by that user's privileges rather than granting SYSTEM directly. The AV:L vector means there is no remotely reachable service; delivery relies on social engineering (email attachment, download, or file share). Preview Pane handling can sometimes reduce the interaction required for Office file bugs, but the available data does not confirm Preview Pane as a trigger for this specific CVE, so assume an explicit file-open is needed. Affected across Windows (x64/x86) and at least one macOS Office LTSC build per CPE data.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H, base 7.8 HIGH) describes a classic client-side code-execution flaw: no privileges required, but the victim must open a malicious workbook, and the attack vector is Local because exploitation hinges on local file processing rather than a network service. Signals are consistent rather than conflicting: there is no CISA KEV entry and no public POC in the provided data, so the correct status is 'no public exploit identified at time of analysis.' The EPSS score of 0.61% (48th percentile) is modest, indicating no observed mass-exploitation trend as of analysis - which aligns with the absence of KEV. SSVC-style reasoning: exploitation is not automatable (requires per-victim social engineering and user interaction), but technical impact is total (full C/I/A compromise with code execution in the user's context). The net picture is a widely deployed product (Office/Excel) with a high-impact but interaction-gated bug - a routine 'patch in your normal Patch Tuesday cycle' item that becomes urgent if a POC or weaponized document appears. No key data is directly contradictory; the main gap is the absence of an independently confirmed patched build number and the sparse single-reference sourcing.

An attacker emails or otherwise delivers a specially crafted Excel spreadsheet to a target and lures them into opening it. On open, Excel mishandles a freed object (CWE-416 use-after-free), and the attacker reclaims the freed memory to hijack control flow and execute arbitrary code in the context of the current user. No public exploit code is identified at time of analysis, and because the CVSS vector is AV:L with UI:R, success depends entirely on the victim opening the malicious file.