Microsoft Excel
CVE-2025-62556
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Excel file via phishing
-
ExploitVictim opens file in Excel
-
ExecutionTrigger untrusted pointer dereference
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Untrusted pointer prevention
|
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted Excel document (UI:R) in a locally installed vulnerable build of Excel / Office / 365 Apps / Office LTSC (2016, 2019, 2021, 2024, and macOS LTSC per CPE). There is no special non-default feature or configuration required - Excel's normal file-parsing path is the trigger - but the attack is gated by social engineering: the attacker must convince the user to open the file, and Protected View / Mark-of-the-Web warnings and Office macro/file-block policies can interrupt the chain. Code runs only in the opening user's context (S:U), not SYSTEM, so a non-privileged user limits immediate blast radius. |
| Impact | This is a classic Office client-side remote code execution flaw (CWE-822 untrusted pointer dereference) that scores CVSS 7.8 HIGH but carries meaningfully lower real-world urgency than that number alone suggests. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R confirms the attack is Local (AV:L) and requires User Interaction (UI:R) - i.e. a victim must open a malicious Excel file - so this is not a wormable, remotely-triggerable network bug despite the HIGH C/I/A impacts. The signals are consistent and point to moderate priority: EPSS is only 0.56% (45th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code was provided in the intelligence, so there is no public exploit identified at time of analysis. Note one data-quality conflict: the input Tags include 'Authentication Bypass,' which contradicts the CWE-822 memory-corruption/code-execution nature of this bug and the vector (PR:N with UI:R is a user-opens-file RCE, not an auth bypass) - treat that tag as mislabeled. In short, a real but not emergency priority: patch in the normal Patch Tuesday cycle, with the main residual risk being phishing/social-engineering delivery of weaponized spreadsheets. |
| Exploit ScenarioDerived | An attacker emails a victim a crafted .xlsx/.xls file (or hosts it on a shared drive or phishing page) and lures them into opening it in a vulnerable Excel build. On open, Excel dereferences an attacker-controlled pointer, corrupting memory and executing arbitrary code in the user's security context. No public exploit code was identified at time of analysis; exploitation depends on social engineering since AV:L/UI:R require the victim to open the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Untrusted pointer dereference in Microsoft Excel (CWE-822) lets an attacker execute arbitrary code in the context of any user who opens a crafted spreadsheet, affecting Excel 2016, Office 2019, Office LTSC 2021 (Windows and macOS), Office LTSC 2024 and Microsoft 365 Apps for Enterprise (CVSS 7.8, AV:L/PR:N/UI:R/S:U, high confidentiality, integrity and availability impact). The flaw requires no privileges and no non-default configuration, but it is gated by social engineering - the victim must open the file - and Protected View, Mark-of-the-Web warnings and Office file/extension block policies can interrupt the chain, with code confined to the opening user's context rather than SYSTEM. No public exploit identified at time of analysis, and EPSS is low at 0.56% (45th percentile), so urgency is driven by patch hygiene rather than observed activity.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update published for CVE-2025-62556 through the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62556, which enumerates the exact KB/build for each affected product; the input provided to this analysis did not include specific fix version numbers, so confirm the currently installed build against that advisory for your servicing channel (Current Channel or Monthly Enterprise Channel for Microsoft 365 Apps, and LTSC servicing for Office 2016, 2019, 2021 and 2024, including macOS LTSC 2021). Until every endpoint is updated, prioritize controls that attack the UI:R prerequisite: keep Protected View enabled for files originating from the internet and other unsafe locations and leave Mark-of-the-Web intact (trade-off: users see a preview/Enable Editing prompt and legitimate downloaded workbooks need an extra click); enforce Office file-block and legacy-extension policies for untrusted paths, and configure Attack Surface Reduction rules such as 'Block Office applications from creating child processes' and 'Block Win32 API calls from Office macros', plus macro-blocking for files from the internet (trade-off: these can break add-ins, macros and spreadsheet-driven automation, so stage them through pilot rings first). Microsoft Defender Application Guard for Office can detonate untrusted documents in a hardware-isolated container as an additional layer (trade-off: performance overhead and extra user friction), and mail/web gateway filtering or sandboxing of inbound Excel attachments raises the cost of delivery, though detection is probabilistic and must not be treated as a substitute for applying the vendor update.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-822 (Untrusted Pointer Dereference) means Excel follows a pointer whose value ultimately derives from attacker-controlled document content rather than a validated, program-controlled address. In practice the attacker crafts a spreadsheet that drives Excel's normal native file-parsing and rendering path - no special feature toggle or non-default setting is needed - into dereferencing an out-of-range or attacker-influenced pointer, corrupting memory in a way that can be steered toward arbitrary code execution and full read/write access to the user's data. The supplied CPE set maps exposure precisely: Microsoft 365 Apps for Enterprise (x86 and x64), Excel 2016 (x86/x64), Office 2019 (x86/x64), Office LTSC 2021 (x86/x64 and macOS) and Office LTSC 2024 (x64); Microsoft's CNA tags also attach Office Online Server and an 'Authentication Bypass' label, but that label is not reflected in the assessed vector, which is squarely a local, user-interaction-driven code-execution issue with Scope Unchanged. Because AV is Local with S:U, the attacker gains only the privileges of the parsing user, and the CVSS vector shows PR:N, meaning no prior privileges or credentialed access on the target are required - the only real barrier is convincing someone to open the document.
Know when Office gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open RCE: AV:L and UI:R because the victim must open a crafted file locally; PR:N as no prior authentication is needed; full C/I/A impact in the user's context (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Executive ViewAI
Microsoft Excel is affected by CVE-2025-62556, a high-severity flaw that can allow arbitrary code execution in the context of any user who opens a crafted spreadsheet, potentially exposing, altering, or disrupting data on affected endpoints. The risk spans Excel 2016, Office 2019, Office LTSC 2021 on Windows and macOS, Office LTSC 2024, and Microsoft 365 Apps for Enterprise, and because no vendor patch is currently available, leadership should prioritize exposure reduction and user protection. No public exploit identified at time of analysis, but the issue is unauthenticated with user interaction required and can be interrupted by existing Office defenses, so urgency is driven by patch hygiene and social-engineering resilience.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce Protected View, Mark-of-the-Web warnings, Office file/extension block policies, email and web gateway attachment filtering for spreadsheets, application allowlisting, least privilege, and user awareness for unsolicited files; monitor vendor advisory for CVE-2025-62556.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbit
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Offic
Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 201
Microsoft Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, and Lyn
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
GitHub PoC
Exploit-DB