CVE-2023-29325: Windows OLE use-after-free remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 7.5 and a very high EPSS percentile indicate serious risk, but exploitation requires user interaction and there is no KEV listing or confirmed in-the-wild exploitation in the record.

What it is

CVE-2023-29325 is a use-after-free flaw in Windows OLE that can lead to remote code execution. Microsoft rates it high severity (CVSS 3.1 7.5), and the flaw affects a broad set of Windows 10, Windows 11 and Windows Server releases. Because OLE is used broadly across Office and Windows document handling, successful exploitation could give an attacker code execution in the context of the victim.

Impact

An attacker who exploits the flaw can execute arbitrary code on the target system, with the impact scoped to the privileges of the user who opens the malicious content. That can mean full compromise of confidentiality, integrity and availability for that user's session.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), meaning a victim must open or interact with crafted content. No specific delivery mechanism is described in the record beyond the OLE context.

Exploitation

The record does not list this CVE in CISA KEV and documents no ransomware use, but EPSS is very high (0.84386, 99.7th percentile), indicating elevated predicted exploitation activity. The only references are Microsoft's patch and vendor advisory pages.

What to do

• Apply the Microsoft security update for CVE-2023-29325 on all affected Windows 10, Windows 11 and Windows Server versions.
• Prioritize patching internet-facing and user-workstation systems, since exploitation requires a user to open crafted content.
• Restrict or block untrusted OLE/embedded-object content in email and web downloads where business processes allow.
• Maintain endpoint protection and attack-surface reduction rules that block suspicious OLE and document-handling behavior.

Detection

• Monitor for Office or Windows processes spawning unexpected child processes such as script interpreters or command shells after document open.
• Alert on crashes or anomalous memory behavior in OLE-related components (e.g., ole32.dll) on endpoints.
• Hunt for documents containing embedded OLE objects arriving from external or untrusted senders.
• Correlate endpoint telemetry with Microsoft patch deployment status to find unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.