Cyber Posture

CVE-2025-24082

High

Published: 11 March 2025

Published
11 March 2025
Modified
02 July 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0020 42.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

CVE-2025-24082 is a use-after-free vulnerability (CWE-416) in Microsoft Office Excel. It affects the Excel component of Microsoft Office, enabling an unauthorized attacker to execute code locally on a victim's machine. The vulnerability was published on 2025-03-11 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.

An unauthorized local attacker can exploit this vulnerability by tricking a user into performing an action, such as opening a malicious Excel file, due to the requirement for user interaction and local access vector with low attack complexity and no privileges needed. Successful exploitation allows arbitrary code execution in the context of the affected process, potentially leading to full local compromise of the system.

Microsoft has published details and guidance in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24082, which security practitioners should consult for patch availability and mitigation recommendations.

Details

CWE(s)
CWE-416

Affected Products

microsoft
365 apps
all versions
microsoft
excel
2016
microsoft
office
2019
microsoft
office long term servicing channel
2021, 2024
microsoft
office online server
all versions

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Use-after-free in Excel enables arbitrary code execution via malicious file opened by user, directly mapping to client-side exploitation and malicious file execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References