Microsoft Excel CVE-2025-62564

Exploitation requires a user on the target host to open or preview a specially crafted Excel file in a vulnerable Microsoft Office/Excel build (365 Apps, Excel 2016, Office 2019, or Office LTSC 2021/2024, including macOS LTSC 2021). The attack vector is local (AV:L): the attacker cannot trigger this purely over the network and must deliver the file (email attachment, download, shared drive) and rely on the victim to open it (UI:R). Key limiting factors that reduce real-world risk: mandatory user interaction, the need to bypass or socially-engineer past Office Protected View / Mark-of-the-Web warnings on files from untrusted sources, and the fact that code executes only in the opening user's privilege context (S:U, no privilege escalation).

This is a genuine but moderate-priority vulnerability rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 HIGH) is internally consistent and points to the classic Office file-open exploitation pattern: the attack vector is LOCAL (the malicious workbook must be processed on the target machine), complexity is LOW, no privileges are required (PR:N), but user interaction IS required (UI:R) - the victim must open or preview a crafted file. The high C/I/A triad reflects Microsoft's assessment that an out-of-bounds read (CWE-125) can be chained into local arbitrary code execution in the user's context. Corroborating signals are weak-to-absent: EPSS is only 0.52% (43rd percentile), indicating low modeled probability of exploitation in the next 30 days; there is NO CISA KEV listing and NO public proof-of-concept referenced. These lower-urgency signals are consistent with each other and with the UI:R requirement, which raises the operational bar. Note a semantic tension worth flagging: the root cause is an out-of-bounds READ (typically an information-disclosure/memory-leak primitive, reflected in the 'Information Disclosure' tag), yet both the description and the CVSS impact claim full code execution (I:H/A:H) - this implies the read is leveraged within a larger exploitation chain (e.g., ASLR bypass or type confusion); the exact mechanism is not detailed in the single MSRC reference. Overall: patch in the normal Patch Tuesday cycle; it is not a drop-everything issue absent evidence of active exploitation.

An attacker emails or otherwise delivers a specially crafted Excel spreadsheet to a target and uses social engineering to get the victim to open it. When Excel parses the malicious file, the out-of-bounds read is triggered and leveraged to execute code in the context of the current user. No public exploit code or active exploitation has been identified at the time of analysis, and successful attack depends on the victim opening the file (UI:R).