CVE-2025-59226

HighCVSS 7.8

Published: 14/10/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

Summary

A use-after-free vulnerability in Microsoft Office Visio allows an unauthorized attacker to execute code locally.

Risk Assessment

An attacker could execute arbitrary code in the user's context, potentially leading to system compromise. This affects confidentiality, integrity, and availability.

Recommendation

Apply Microsoft Office security updates. Warn users against opening suspicious files.

Other vulnerabilities in Microsoft Office Visio

See all

CVE-2022-44696High
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to take control of the victim's system.
CVE-2022-44695High
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.
CVE-2022-44694High
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.
CVE-2022-24510High
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.
CVE-2022-24509High
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
CVE-2022-24461High
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to take control of the victim's system.
CVE-2021-38654High
Remote code execution vulnerability in Microsoft Office Visio. It could allow an attacker to execute code on the victim's system.
CVE-2021-38653High
Remote code execution vulnerability in Microsoft Office Visio. Similar to other Visio flaws, it could allow an attacker to run code.
CVE-2026-102855High
A heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
CVE-2026-102857High
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

Original NVD description (English source)

Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS