Summary
Microsoft heeft kwetsbaarheden verholpen in diverse Office producten.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, willekeurige code uit te voeren met rechten van het slachtoffer, of toegang te krijgen tot gevoelige gegevens in de context van het slachtoffer.
Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide bestand te openen, of link te volgen.
```
Microsoft Office SharePoint:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-59228 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2025-59237 | 8.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Microsoft Office Word:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-59221 | 7.00 | Uitvoeren van willekeurige code |
| CVE-2025-59222 | 7.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Microsoft Office Visio:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-59226 | 7.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Microsoft Office PowerPoint:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-59238 | 7.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Microsoft Office:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-59234 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2025-59227 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2025-59229 | 5.50 | Denial-of-Service |
|----------------|------|-------------------------------------|
Microsoft Office Excel:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-59231 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2025-59233 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2025-59235 | 7.10 | Toegang tot gevoelige gegevens |
| CVE-2025-59236 | 8.40 | Uitvoeren van willekeurige code |
| CVE-2025-59243 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2025-59223 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2025-59224 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2025-59225 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2025-59232 | 7.10 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|
```
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 18
-
High 8.8
Microsoft SharePoint Remote Code Execution Vulnerability
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 8.4
Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft PowerPoint Remote Code Execution Vulnerability
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.1
Microsoft Excel Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
-
High 7.1
Microsoft Excel Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
-
High 7.0
Microsoft Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
Medium 5.5
Microsoft Office Denial of Service Vulnerability
Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally.
Revision history
-
#1.0.0
Initiele versie