Microsoft Excel CVE-2025-62561

Exploitation requires the victim to open an attacker-supplied, specially crafted Excel workbook in an affected build of Excel/Office (Microsoft 365 Apps, Excel 2016, Office 2019, or Office LTSC 2021/2024 on Windows x86/x64 or macOS); there is no network-reachable service and no way to trigger the untrusted pointer dereference without that file-open user action (UI:R). Limiting factors: mandatory user interaction, a local/file-based attack vector (AV:L), and execution confined to the opening user's privileges (S:U) mean that Protected View, blocking workbooks from untrusted sources, and mark-of-the-web enforcement materially reduce real-world risk even though no prior authentication is needed (PR:N).

Signals are internally consistent and point to a moderate, user-interaction-gated local code-execution risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes the classic Office file-open primitive: no privileges or prior authentication are needed (PR:N), but the attacker cannot reach the code path without a user opening a crafted workbook (UI:R), and the attack is local/file-based (AV:L) rather than network-reachable. This aligns with CWE-822 (untrusted pointer dereference), where a malformed Excel file steers Excel into dereferencing an attacker-influenced pointer. The EPSS score of 0.52% (43rd percentile) is low-to-moderate, indicating no evidence of broad automated exploitation yet. The CVE is NOT in CISA KEV and no public POC is indicated, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data is present in the input. The main tension is severity versus footprint: individually the flaw is user-gated and local, but because Excel is deployed almost everywhere, phishing-driven mass delivery of malicious workbooks is a well-worn path, so this warrants prompt patching across Office fleets even though the raw signals (low EPSS, no KEV, no POC) argue against treating it as actively weaponized today.

An attacker emails or shares a specially crafted Excel workbook and lures a user into opening it. When Excel parses the malformed file it dereferences an untrusted pointer, corrupting memory and allowing arbitrary code execution in the context of the current user. No public exploit code is known at time of analysis, so this reflects the designed attack primitive rather than an observed campaign.