Description

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.

Classification

CVE ID: CVE-2025-26642

CVSS Base Severity: HIGH

CVSS Base Score: 7.8

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Affected Products

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft

Product: Office Online Server, Microsoft SharePoint Server 2019, Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Excel 2016, Microsoft Office 2016, Microsoft Access 2016 (32-bit edition), Microsoft Access 2016

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.08% (probability of being exploited)

EPSS Percentile: 24.29% (scored less or equal to compared to others)

EPSS Date: 2025-04-18 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-26642
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26642

Timeline