PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-62199 Microsoft CVE debrief

CVE-2025-62199 is a Microsoft Office use-after-free vulnerability (CWE-416) publicly disclosed on 2025-11-11 and later modified on 2025-11-19. The official NVD record rates it HIGH (CVSS 7.8) with a local attack vector, no privileges required, but user interaction required; successful exploitation can impact confidentiality, integrity, and availability at a high level. The NVD CPE list indicates exposure across Microsoft 365 Apps enterprise, Excel 2016, Office for Android, and Office Long Term Servicing Channel 2021/2024 variants on x64, x86, and macOS. This makes the issue important for endpoint fleets that routinely open Office documents, even though no Known Exploited Vulnerabilities entry is included in the supplied data.

Vendor
Microsoft
Product
Office Long Term Servicing Channel
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-11-11
Original CVE updated
2025-11-19
Advisory published
2025-11-11
Advisory updated
2025-11-19

Who should care

Endpoint and patch-management teams responsible for Microsoft Office deployments, especially Microsoft 365 Apps, Excel 2016, Office LTSC 2021/2024, and Office on Android/macOS. It is also relevant for organizations that frequently receive or open external Office files.

Technical summary

Microsoft describes the flaw as a use-after-free in Office. The published CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) means an attacker needs local access and user interaction, but no privileges. NVD maps the weakness to CWE-416 and lists affected Office-related CPEs across multiple product variants.

Defensive priority

High. Apply Microsoft updates promptly, verify whether your specific Office builds match the affected CPEs in the NVD record, and prioritize systems that handle untrusted documents or shared files.

Recommended defensive actions

  • Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-62199.
  • Inventory Office LTSC 2021/2024, Microsoft 365 Apps, Excel 2016, and Office on Android/macOS to confirm exposure.
  • Prioritize patching workstations and VDI images used to open external or shared Office documents.
  • Until patched, reduce exposure to untrusted Office files and attachments using existing organizational controls.
  • Recheck Microsoft guidance after updates; the CVE was modified on 2025-11-19, so confirm the latest advisory details before closing the ticket.

Evidence notes

This debrief is based on the official CVE/NVD records and the Microsoft MSRC advisory link provided in the corpus. NVD lists CWE-416 and CVSS v3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and the CPE list includes Microsoft 365 Apps enterprise, Excel 2016, Office for Android, and Office LTSC 2021/2024 variants. No KEV entry was supplied, so exploitation in the wild is not asserted here.

Official resources

Publicly disclosed in official records on 2025-11-11 and modified on 2025-11-19. The supplied corpus does not include a Known Exploited Vulnerabilities entry.