Security Vulnerabilities - CVEs Published In October 2025
Improper link resolution before file access ('link following') in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
CVSS Score
7.8
EPSS Score
0.003
Published
2025-10-14
Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS Score
7.8
EPSS Score
0.004
Published
2025-10-14
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score
7.8
EPSS Score
0.005
Published
2025-10-14
External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.
CVSS Score
6.5
EPSS Score
0.008
Published
2025-10-14
Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVSS Score
7.5
EPSS Score
0.01
Published
2025-10-14
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score
7.8
EPSS Score
0.006
Published
2025-10-14
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVSS Score
7.1
EPSS Score
0.007
Published
2025-10-14
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score
8.4
EPSS Score
0.004
Published
2025-10-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS Score
8.8
EPSS Score
0.025
Published
2025-10-14
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
CVSS Score
7.8
EPSS Score
0.004
Published
2025-10-14