Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

cve CVE-2025-62554 1 source, 1 claim · Watch

NVD writes:
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. Acceso a un recurso utilizando un tipo incompatible ('confusión de tipos') en Microsoft Office permite a un atacante no autorizado ejecutar código localmente. the claim

What it is to other things

affectsmicrosoft/365_apps
NVD
affectsmicrosoft/365_copilot
NVD
affectsmicrosoft/office
NVD
affectsmicrosoft/office_long_term_servicing_channel
NVD
made_bymicrosoft
NVD

In words only, so not counted until a person confirms one:

affectsmicrosoft/microsoft_365_apps_for_enterprise
NVD says “Microsoft · Microsoft 365 Apps for Enterprise”

What each source says

PropertySourceSaidMeans here
Cvss
cvss
NVD8.4
receipt
Source
NVD
Its words
8.4
Read by
field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft 365 Apps for Enterprise",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office 2016",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.0.5530.1001",
                "status": "affected",
                "version": "16.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office 2019",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "19.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "Microsoft Office for Android",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.0.19530.20000",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office LTSC 2021",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office LTSC 2024",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "16.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "Microsoft Office LTSC for Mac 2021",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.104.25121423",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "Microsoft Office LTSC for Mac 2024",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.104.25121423",
                "status": "affected",
                "version": "16.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "secure@microsoft.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*",
                "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*",
                "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:365_copilot:-:*:*:*:*:android:*:*",
                "matchCriteriaId": "2D37C2C3-A2A0-41D9-8C71-F0191702189D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*",
                "matchCriteriaId": "72324216-4EB3-4243-A007-FEF3133C7DF9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*",
                "matchCriteriaId": "0FBB0E61-7997-4F26-9C07-54912D3F1C10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*",
                "matchCriteriaId": "CF5DDD09-902E-4881-98D0-CB896333B4AA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*",
                "matchCriteriaId": "26A3B226-5D7C-4556-9350-5222DC8EFC2C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*",
                "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*",
                "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*",
                "matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*",
                "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*",
                "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*",
                "matchCriteriaId": "EF3E56B5-E6A6-4061-9380-D421E52B9199",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally."
      },
      {
        "lang": "es",
        "value": "Acceso a un recurso utilizando un tipo incompatible ('confusión de tipos') en Microsoft Office permite a un atacante no autorizado ejecutar código localmente."
      }
    ],
    "id": "CVE-2025-62554",
    "lastModified": "2026-09-30T20:10:00.247",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.5,
          "impactScore": 5.9,
          "source": "secure@microsoft.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62554",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T04:56:34.398500Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-09T18:16:00.620",
    "references": [
      {
        "source": "secure@microsoft.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62554"
      }
    ],
    "sourceIdentifier": "secure@microsoft.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "secure@microsoft.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Product
product
NVDMicrosoft 365 Apps for Enterprise
receipt
Source
NVD
Its words
Microsoft 365 Apps for Enterprise
Read by
field:cve.affected[].affectedData[].product
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft 365 Apps for Enterprise",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office 2016",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.0.5530.1001",
                "status": "affected",
                "version": "16.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office 2019",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "19.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "Microsoft Office for Android",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.0.19530.20000",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office LTSC 2021",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office LTSC 2024",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "16.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "Microsoft Office LTSC for Mac 2021",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.104.25121423",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "Microsoft Office LTSC for Mac 2024",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.104.25121423",
                "status": "affected",
                "version": "16.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "secure@microsoft.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*",
                "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*",
                "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:365_copilot:-:*:*:*:*:android:*:*",
                "matchCriteriaId": "2D37C2C3-A2A0-41D9-8C71-F0191702189D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*",
                "matchCriteriaId": "72324216-4EB3-4243-A007-FEF3133C7DF9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*",
                "matchCriteriaId": "0FBB0E61-7997-4F26-9C07-54912D3F1C10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*",
                "matchCriteriaId": "CF5DDD09-902E-4881-98D0-CB896333B4AA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*",
                "matchCriteriaId": "26A3B226-5D7C-4556-9350-5222DC8EFC2C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*",
                "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*",
                "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*",
                "matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*",
                "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*",
                "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*",
                "matchCriteriaId": "EF3E56B5-E6A6-4061-9380-D421E52B9199",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally."
      },
      {
        "lang": "es",
        "value": "Acceso a un recurso utilizando un tipo incompatible ('confusión de tipos') en Microsoft Office permite a un atacante no autorizado ejecutar código localmente."
      }
    ],
    "id": "CVE-2025-62554",
    "lastModified": "2026-09-30T20:10:00.247",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.5,
          "impactScore": 5.9,
          "source": "secure@microsoft.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62554",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T04:56:34.398500Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-09T18:16:00.620",
    "references": [
      {
        "source": "secure@microsoft.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62554"
      }
    ],
    "sourceIdentifier": "secure@microsoft.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "secure@microsoft.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft 365 Apps for Enterprise",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office 2016",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.0.5530.1001",
                "status": "affected",
                "version": "16.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office 2019",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "19.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "Microsoft Office for Android",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.0.19530.20000",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office LTSC 2021",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office LTSC 2024",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "16.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "Microsoft Office LTSC for Mac 2021",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.104.25121423",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "Microsoft Office LTSC for Mac 2024",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.104.25121423",
                "status": "affected",
                "version": "16.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "secure@microsoft.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*",
                "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*",
                "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:365_copilot:-:*:*:*:*:android:*:*",
                "matchCriteriaId": "2D37C2C3-A2A0-41D9-8C71-F0191702189D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*",
                "matchCriteriaId": "72324216-4EB3-4243-A007-FEF3133C7DF9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*",
                "matchCriteriaId": "0FBB0E61-7997-4F26-9C07-54912D3F1C10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*",
                "matchCriteriaId": "CF5DDD09-902E-4881-98D0-CB896333B4AA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*",
                "matchCriteriaId": "26A3B226-5D7C-4556-9350-5222DC8EFC2C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*",
                "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*",
                "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*",
                "matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*",
                "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*",
                "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*",
                "matchCriteriaId": "EF3E56B5-E6A6-4061-9380-D421E52B9199",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally."
      },
      {
        "lang": "es",
        "value": "Acceso a un recurso utilizando un tipo incompatible ('confusión de tipos') en Microsoft Office permite a un atacante no autorizado ejecutar código localmente."
      }
    ],
    "id": "CVE-2025-62554",
    "lastModified": "2026-09-30T20:10:00.247",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.5,
          "impactScore": 5.9,
          "source": "secure@microsoft.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62554",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T04:56:34.398500Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-09T18:16:00.620",
    "references": [
      {
        "source": "secure@microsoft.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62554"
      }
    ],
    "sourceIdentifier": "secure@microsoft.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "secure@microsoft.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDMicrosoft
receipt
Source
NVD
Its words
Microsoft
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft 365 Apps for Enterprise",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office 2016",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.0.5530.1001",
                "status": "affected",
                "version": "16.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office 2019",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "19.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "Microsoft Office for Android",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.0.19530.20000",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office LTSC 2021",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "platforms": [
              "32-bit Systems",
              "x64-based Systems"
            ],
            "product": "Microsoft Office LTSC 2024",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "https://aka.ms/OfficeSecurityReleases",
                "status": "affected",
                "version": "16.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "Microsoft Office LTSC for Mac 2021",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.104.25121423",
                "status": "affected",
                "version": "16.0.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "Microsoft Office LTSC for Mac 2024",
            "vendor": "Microsoft",
            "versions": [
              {
                "lessThan": "16.104.25121423",
                "status": "affected",
                "version": "16.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "secure@microsoft.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*",
                "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*",
                "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:365_copilot:-:*:*:*:*:android:*:*",
                "matchCriteriaId": "2D37C2C3-A2A0-41D9-8C71-F0191702189D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*",
                "matchCriteriaId": "72324216-4EB3-4243-A007-FEF3133C7DF9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*",
                "matchCriteriaId": "0FBB0E61-7997-4F26-9C07-54912D3F1C10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*",
                "matchCriteriaId": "CF5DDD09-902E-4881-98D0-CB896333B4AA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*",
                "matchCriteriaId": "26A3B226-5D7C-4556-9350-5222DC8EFC2C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*",
                "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*",
                "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*",
                "matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*",
                "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*",
                "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*",
                "matchCriteriaId": "EF3E56B5-E6A6-4061-9380-D421E52B9199",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally."
      },
      {
        "lang": "es",
        "value": "Acceso a un recurso utilizando un tipo incompatible ('confusión de tipos') en Microsoft Office permite a un atacante no autorizado ejecutar código localmente."
      }
    ],
    "id": "CVE-2025-62554",
    "lastModified": "2026-09-30T20:10:00.247",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.5,
          "impactScore": 5.9,
          "source": "secure@microsoft.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62554",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T04:56:34.398500Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-09T18:16:00.620",
    "references": [
      {
        "source": "secure@microsoft.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62554"
      }
    ],
    "sourceIdentifier": "secure@microsoft.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "secure@microsoft.com",
        "type": "Secondary"
      }
    ]
  }
}
—

vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
zetlyn/cve-nvd · 2025-12-09
cvss 8.4 product Microsoft 365 Apps for Enterprise status Analyzed vendor Microsoft source