Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

The Microsoft Excel Products are missing a security update. It is, therefore, affected by the following vulnerabilities:

  - Multiple remote code execution vulnerabilities that attackers can exploit to bypass authentication and     execute unauthorized arbitrary commands. (CVE-2025-59223, CVE-2025-59224, CVE-2025-59225, CVE-2025-59231,     CVE-2025-59233, CVE-2025-59236, CVE-2025-59243)

  - Information disclosure vulnerabilities. (CVE-2025-59232, CVE-2025-59235)     Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Excel Products are missing a security update. They are, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2025-59223, CVE-2025-59224, CVE-2025-59225, CVE-2025-59231,     CVE-2025-59233)

  - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive     information. (CVE-2025-59232, CVE-2025-59235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Remote Code Execution Vulnerability.     (CVE-2025-59221, CVE-2025-59222, CVE-2025-59228, CVE-2025-59237)   
  - Information Disclosure Vulnerability     (CVE-2025-59232, CVE-2025-59235)

The Microsoft Office Products are missing security updates. They are, therefore, affected by multiple vulnerabilities.

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2025-59226, CVE-2025-59227, CVE-2025-59234)

  - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive     information. (CVE-2025-59232, CVE-2025-59235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Remote Code Execution Vulnerability.     (CVE-2025-59221, CVE-2025-59222, CVE-2025-59228, CVE-2025-59237)   
  - Information Disclosure Vulnerability     (CVE-2025-59232, CVE-2025-59235)

The Microsoft Access Products are missing a security update. It is, therefore, affected by multiple information disclosure vulnerabilities. An unauthenticated, local attacker can exploit these, via an out-of-bounds read, to disclose potentially sensitive information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Office Online Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities.

  - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
    (CVE-2025-59223, CVE-2025-59224, CVE-2025-59225, CVE-2025-59236)

  - Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an     unauthorized attacker to execute code locally. (CVE-2025-59231, CVE-2025-59233)

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information     locally. (CVE-2025-59232, CVE-2025-59235)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Remote Code Execution Vulnerability. (CVE-2025-59228, CVE-2025-59237)   
  - Information Disclosure Vulnerability (CVE-2025-59235)

ID	Name	Product	Family	Severity
271234	Security Updates for Microsoft Excel Products C2R (October 2025)	Nessus	Windows	high
270389	Security Updates for Microsoft Excel Products (October 2025)	Nessus	Windows : Microsoft Bulletins	high
270388	Security Updates for Microsoft SharePoint Server 2019 (October 2025)	Nessus	Windows : Microsoft Bulletins	high
270387	Security Updates for Microsoft Office Products (October 2025)	Nessus	Windows : Microsoft Bulletins	high
270383	Security Updates for Microsoft SharePoint Server 2016 (October 2025)	Nessus	Windows : Microsoft Bulletins	high
270382	Security Updates for Microsoft Access Products (October 2025)	Nessus	Windows : Microsoft Bulletins	high
270376	Security Updates for Microsoft Office Online Server (October 2025)	Nessus	Windows : Microsoft Bulletins	high
270372	Security Updates for Microsoft SharePoint Server Subscription Edition (October 2025)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2025-59235

high

Tenable Plugins

high

high

high

high

high

high

high

high