← Back

CVE-2025-62554

nvd nist
Published: Dec 9, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

Affected (13)

Microsoft
4 products
365 Apps
365 Copilot
Office
Office Long Term Servicing Channel
Configuration A
13 vulnerable
Vulnerable SoftwareAffected Versions
Microsoft
365 Apps
All versions
365 Apps
All versions
365 Copilot
All versions
Microsoft
Office
Version 2016
Office
Version 2016
Office
Version 2019
Office
Version 2019
Microsoft
Office Long Term Servicing Channel
Version 2021
Office Long Term Servicing Channel
Version 2021
Office Long Term Servicing Channel
Version 2021
Office Long Term Servicing Channel
Version 2024
Office Long Term Servicing Channel
Version 2024
Office Long Term Servicing Channel
Version 2024

Related CWEs

CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References (1)

Source: secure@microsoft.com
Vendor Advisory

Timeline

No history available yet.