PT-2025-15498 · Microsoft · Office+3

Published 2025-04-08 · Updated 2025-04-15 · CVE-2025-26642

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office (affected versions not specified)

Description The issue is related to an out-of-bounds read in Microsoft Office, allowing an unauthorized attacker to execute code locally. It also enables remote attackers to execute arbitrary code and affect the system. The vulnerability is associated with integer overflow and can be exploited by sending a specially crafted file.

Recommendations To resolve the issue, customers running affected Mac software should install the available security update for their product. Customers running other Microsoft Office software do not need to take any action. As a temporary workaround, consider restricting access to vulnerable components until a patch is applied.

Fix

RCE

Out of bounds Read

Integer Overflow

Weakness Enumeration

CWE-125

CWE-190

Related Identifiers

BDU:2025-04108

CVE-2025-26642

Affected Products

Office

Office Access

Office Excel

Sharepoint Server

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26642 · Security Note
• https://bdu.fstec.ru/vul/2025-04108 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-26642 · Security Note
• https://osv.dev/vulnerability/CVE-2025-26642 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26642 · Vendor Advisory
• https://twitter.com/CVEnew/status/1909906952462729707 · Twitter Post
• https://t.me/msrcreports/1987 · Telegram Post