EUVD-2025-17725
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Analysis
Heap-based buffer overflow vulnerability in Microsoft Office Excel that allows local attackers to execute arbitrary code with high privileges (confidentiality, integrity, and availability impact). The vulnerability requires user interaction (opening a malicious Excel file) but no special privileges, making it a practical threat to Excel users. With a CVSS score of 7.8 and local attack vector, this represents a significant code execution risk for organizations relying on Excel for document processing.
Technical Context
The vulnerability exists in Microsoft Office Excel's file parsing engine, specifically in heap memory management during the processing of crafted spreadsheet files. CWE-122 (Heap-based Buffer Overflow) indicates improper bounds checking when allocating or accessing heap memory—likely occurring during parsing of Excel file structures (XLSX/XLS formats) where attacker-controlled data is used to determine buffer sizes or offsets without adequate validation. The affected technology involves Excel's document parsing libraries (likely involving Office Open XML or legacy OLE compound document format processors) which handle binary serialization of cell data, formulas, or embedded objects. This is a memory safety issue in native code components of Microsoft Office, not a scripting or macro-based vulnerability.
Affected Products
Microsoft Office Excel (specific versions not provided in source data, but typically affects multiple versions from legacy XLS through modern XLSX). Without explicit CPE strings or vendor advisory, affected products likely include: Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 (subscription versions), and potentially Microsoft Excel standalone applications. The vulnerability affects all configurations where Excel processes untrusted spreadsheet files. Vendor advisory and exact patched versions require consultation of Microsoft Security Update Guide or official CVE advisory pages.
Remediation
Immediate actions: (1) Apply Microsoft security patches when released via Windows Update or Microsoft Update; (2) restrict opening of Excel files from untrusted sources; (3) use Microsoft Defender or equivalent endpoint protection with file scanning enabled; (4) disable Excel file auto-opening features in email clients; (5) educate users to avoid opening unsolicited Excel attachments. Longer-term mitigations include using Protected View/Sandbox mode in Excel (if not already enabled), deploying application whitelisting policies, and implementing file type restrictions via Group Policy or email gateways. Monitor Microsoft Security Response Center (MSRC) for patch availability and apply updates to affected Office versions immediately upon release.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today