Type Confusion Vulnerability in Microsoft Office
CVE-2025-62554

8.4HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Office Ltsc 2024
Microsoft Office 2019
Microsoft Office For Android
Microsoft Office Ltsc For Mac 2021
Vendor
CVE Published:
9 December 2025

What is CVE-2025-62554?

A type confusion vulnerability in Microsoft Office enables unauthorized attackers to exploit the software by causing the application to access a resource using an incompatible data type. This flaw can lead to local code execution, putting sensitive data and system integrity at risk. Users are encouraged to apply the latest security updates to mitigate potential threats.

Affected Version(s)

Microsoft 365 Apps for Enterprise 32-bit Systems 16.0.1

Microsoft Office 2016 32-bit Systems 16.0.0 < 16.0.5530.1001

Microsoft Office 2019 x64-based Systems 19.0.0

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-62554 : Type Confusion Vulnerability in Microsoft Office