CVE-2025-62554: Microsoft Office Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
Other sources
Microsoft Office Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.104.25121423 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.5530.1001Patch KB5002819 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.19530.20000
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62554?
CVE-2025-62554 is a high-severity vulnerability that allows remote code execution in Microsoft Office.
How do I fix CVE-2025-62554?
To fix CVE-2025-62554, ensure you update your Microsoft Office software to the latest security patches provided by Microsoft.
Which Microsoft products are affected by CVE-2025-62554?
CVE-2025-62554 affects various Microsoft Office products including Office 2016, Office 2019, Office 2021, and Office LTSC 2024.
Can CVE-2025-62554 be exploited remotely?
Yes, CVE-2025-62554 can be exploited remotely by an unauthorized attacker to execute code locally.
Is there a workaround for CVE-2025-62554?
There is no official workaround for CVE-2025-62554, so patching is the recommended mitigation.