Microsoft Office Use-After-Free Remote Code Execution Vulnerability

CVE-2025-62557 is a Microsoft Office memory-corruption vulnerability caused by a use-after-free condition in Office document parsing. Public reporting and Microsoft-linked summaries describe the flaw as allowing an unauthorized attacker to execute code locally in the context of the affected Office process when a specially crafted Office file, malicious link, or crafted email content is parsed. Multiple sources indicate Outlook Preview Pane is an attack vector, meaning exploitation may occur when a booby-trapped email is rendered or previewed, without the victim explicitly opening the attachment in the worst case. The vulnerability is rated Critical with CVSS v3.1 8.4, and public references characterize it as an Office/Outlook remote code execution issue despite the CVSS attack vector being local because the vulnerable parsing is typically reached through remotely delivered content such as phishing emails or shared documents.