EUVD-2025-17725CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow vulnerability in Microsoft Office Excel that allows local attackers to execute arbitrary code with high privileges (confidentiality, integrity, and availability impact). The vulnerability requires user interaction (opening a malicious Excel file) but no special privileges, making it a practical threat to Excel users. With a CVSS score of 7.8 and local attack vector, this represents a significant code execution risk for organizations relying on Excel for document processing.
Technical ContextAI
The vulnerability exists in Microsoft Office Excel's file parsing engine, specifically in heap memory management during the processing of crafted spreadsheet files. CWE-122 (Heap-based Buffer Overflow) indicates improper bounds checking when allocating or accessing heap memory—likely occurring during parsing of Excel file structures (XLSX/XLS formats) where attacker-controlled data is used to determine buffer sizes or offsets without adequate validation. The affected technology involves Excel's document parsing libraries (likely involving Office Open XML or legacy OLE compound document format processors) which handle binary serialization of cell data, formulas, or embedded objects. This is a memory safety issue in native code components of Microsoft Office, not a scripting or macro-based vulnerability.
RemediationAI
Immediate actions: (1) Apply Microsoft security patches when released via Windows Update or Microsoft Update; (2) restrict opening of Excel files from untrusted sources; (3) use Microsoft Defender or equivalent endpoint protection with file scanning enabled; (4) disable Excel file auto-opening features in email clients; (5) educate users to avoid opening unsolicited Excel attachments. Longer-term mitigations include using Protected View/Sandbox mode in Excel (if not already enabled), deploying application whitelisting policies, and implementing file type restrictions via Group Policy or email gateways. Monitor Microsoft Security Response Center (MSRC) for patch availability and apply updates to affected Office versions immediately upon release.
More from same product – last 7 days
{filename} endpoint. The flawed traversal filter only rejects forward slashes and '..' sequences, leaving absolute Windo
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Share
External POC / Exploit Code
Leaving vuln.today