CVE-2025-59232 - Microsoft Excel Information Disclosure Vulnerability

Back Back to CVE browser

HIGH

Microsoft Excel Information Disclosure Vulnerability

Published Oct 14, 2025

7.1

HIGH

CVSS 3.1

EPSS 0.48%

Description

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Affected products

Vendor Microsoft Product Microsoft 365 Apps for Enterprise Default
n/a
- Version
  16.0.1
  Status
  affected
  Constraints
  <https://aka.ms/OfficeSecurityReleases
Vendor Microsoft Product Microsoft Access 2016 Default
n/a
- Version
  16.0.0
  Status
  affected
  Constraints
  <16.0.5522.1000
Vendor Microsoft Product Microsoft Access 2016 (32-bit edition) Default
n/a
- Version
  16.0.0
  Status
  affected
  Constraints
  <16.0.5522.1000
Vendor Microsoft Product Microsoft Excel 2016 Default
n/a
- Version
  16.0.0.0
  Status
  affected
  Constraints
  <16.0.5522.1000
Vendor Microsoft Product Microsoft Office 2019 Default
n/a
- Version
  19.0.0
  Status
  affected
  Constraints
  <https://aka.ms/OfficeSecurityReleases
Vendor Microsoft Product Microsoft Office LTSC 2021 Default
n/a
- Version
  16.0.1
  Status
  affected
  Constraints
  <https://aka.ms/OfficeSecurityReleases
Vendor Microsoft Product Microsoft Office LTSC 2024 Default
n/a
- Version
  16.0.0
  Status
  affected
  Constraints
  <https://aka.ms/OfficeSecurityReleases
Vendor Microsoft Product Microsoft Office LTSC for Mac 2021 Default
n/a
- Version
  16.0.1
  Status
  affected
  Constraints
  <16.102.25101223
Vendor Microsoft Product Microsoft Office LTSC for Mac 2024 Default
n/a
- Version
  16.0.0
  Status
  affected
  Constraints
  <16.102.25101223
Vendor Microsoft Product Microsoft SharePoint Enterprise Server 2016 Default
n/a
- Version
  16.0.0
  Status
  affected
  Constraints
  <16.0.5522.1000
Vendor Microsoft Product Microsoft SharePoint Server 2019 Default
n/a
- Version
  16.0.0
  Status
  affected
  Constraints
  <16.0.10417.20059
Vendor Microsoft Product Office Online Server Default
n/a
- Version
  16.0.0.0
  Status
  affected
  Constraints
  <16.0.10417.20059

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Microsoft 365 Apps for Enterprise

n/a

Version	Status	Constraints
16.0.1	affected	<https://aka.ms/OfficeSecurityReleases

Microsoft

Microsoft Access 2016

n/a

Version	Status	Constraints
16.0.0	affected	<16.0.5522.1000

Microsoft

Microsoft Access 2016 (32-bit edition)

n/a

Version	Status	Constraints
16.0.0	affected	<16.0.5522.1000

Microsoft

Microsoft Excel 2016

n/a

Version	Status	Constraints
16.0.0.0	affected	<16.0.5522.1000

Microsoft

Microsoft Office 2019

n/a

Version	Status	Constraints
19.0.0	affected	<https://aka.ms/OfficeSecurityReleases

Microsoft

Microsoft Office LTSC 2021

n/a

Version	Status	Constraints
16.0.1	affected	<https://aka.ms/OfficeSecurityReleases

Microsoft

Microsoft Office LTSC 2024

n/a

Version	Status	Constraints
16.0.0	affected	<https://aka.ms/OfficeSecurityReleases

Microsoft

Microsoft Office LTSC for Mac 2021

n/a

Version	Status	Constraints
16.0.1	affected	<16.102.25101223

Microsoft

Microsoft Office LTSC for Mac 2024

n/a

Version	Status	Constraints
16.0.0	affected	<16.102.25101223

Microsoft

Microsoft SharePoint Enterprise Server 2016

n/a

Version	Status	Constraints
16.0.0	affected	<16.0.5522.1000

Microsoft

Microsoft SharePoint Server 2019

n/a

Version	Status	Constraints
16.0.0	affected	<16.0.10417.20059

Microsoft

Office Online Server

n/a

Version	Status	Constraints
16.0.0.0	affected	<16.0.10417.20059

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59232
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59232		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Oct 14, 2025

Updated Feb 22, 2026

Reserved Sep 11, 2025

Link CVE-2025-59232

CISA Vulnrichment

Updated Oct 14, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-59232

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-59232

ENISA EUVD

Assigner n/a

Published n/a

Updated n/a

Exploited since n/a

Link n/a