CVE-2025-59232
published 2025-10-14CVE-2025-59232: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
PriorityP431high7.1CVSS 3.1
AVLACLPRNUIRSUCHINAH
EPSS
0.45%
36.6th percentile
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | access | — | — |
| microsoft | excel | — | — |
| microsoft | microsoft_365_apps_for_enterprise | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_access_2016 | >= 16.0.0 < 16.0.5522.1000 | 16.0.5522.1000 |
| microsoft | microsoft_excel_2016 | >= 16.0.0.0 < 16.0.5522.1000 | 16.0.5522.1000 |
| microsoft | microsoft_office_2019 | >= 19.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2021 | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2024 | >= 16.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_for_mac_2021 | >= 16.0.1 < 16.102.25101223 | 16.102.25101223 |
| microsoft | microsoft_office_ltsc_for_mac_2024 | >= 16.0.0 < 16.102.25101223 | 16.102.25101223 |
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < 16.0.5522.1000 | 16.0.5522.1000 |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < 16.0.10417.20059 | 16.0.10417.20059 |
| microsoft | office | — | — |
| microsoft | office_long_term_servicing_channel | — | — |
| microsoft | office_long_term_servicing_channel | — | — |
| microsoft | office_online_server | < 16.0.10417.20059 | 16.0.10417.20059 |
| microsoft | office_online_server | >= 16.0.0.0 < 16.0.10417.20059 | 16.0.10417.20059 |
| microsoft | sharepoint_server | — | — |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_32-bit_systems | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_64-bit_systems | — | — |
| msrc | microsoft_access_2016 | — | — |
| msrc | microsoft_excel_2016 | — | — |
| msrc | microsoft_office_2019_for_32-bit_editions | — | — |
| msrc | microsoft_office_2019_for_64-bit_editions | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
vendor_msrc7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-72hf-w84g-qm39: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally
ghsa_unreviewed·2025-10-14
CVE-2025-59232 [HIGH] CWE-125 GHSA-72hf-w84g-qm39: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft
Microsoft Excel Information Disclosure Vulnerability
vendor_msrc·2025-10-14·CVSS 7.1
CVE-2025-59232 [HIGH] CWE-125 Microsoft Excel Information Disclosure Vulnerability
Microsoft Excel Information Disclosure Vulnerability
Description: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
FAQ: What type of information could be disclosed by this vulnerability?
An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory.
FAQ: Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
FAQ: There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?
Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in an
No detection rules found.
No public exploits indexed.
2025-10-14
Published