Published advisory · CVE-2025-60714
CVE-2025-60714 - Windows OLE Remote Code Execution Vulnerability
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Vulnerability analysis
A heap buffer overflow in Windows OLE can allow an unauthenticated attacker to execute code when a user opens a crafted file. Microsoft identifies the weakness as CWE-122. Although the advisory calls this remote code execution, its CVSS attack vector is local because exploitation occurs on the user’s machine.
Affected Versions
Microsoft lists Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 version 23H2; and Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019 and 2022, including the 23H2 edition. The linked advisory specifies affected architectures, service packs and installation types.
Solution / Mitigation
Apply the November 2025 Windows security update listed for the affected release in Microsoft’s advisory, or a superseding update. The required KB and fixed build vary by Windows version.
Disclosure timeline
- Microsoft published the advisory and security updates
References