CVE-2025-21354: Microsoft Excel RCE Vulnerability

CVE-2025-21354 Overview

CVE-2025-21354 is a remote code execution vulnerability affecting Microsoft Excel and multiple Microsoft Office products. This vulnerability allows attackers to execute arbitrary code on a victim's system when a user opens a specially crafted Excel file. The vulnerability is classified as CWE-822 (Untrusted Pointer Dereference), indicating that the flaw involves improper handling of pointer references that can be manipulated by malicious input.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code with the privileges of the current user, potentially leading to complete system compromise, data theft, or installation of persistent malware.

Affected Products

• Microsoft 365 Apps (Enterprise editions, x64 and x86)
• Microsoft Office 2019 (x64 and x86)
• Microsoft Office Long Term Servicing Channel 2021 (Windows x64/x86 and macOS)
• Microsoft Office Long Term Servicing Channel 2024 (Windows x64/x86 and macOS)
• Microsoft Office Online Server

Discovery Timeline

• January 14, 2025 - CVE-2025-21354 published to NVD
• August 25, 2025 - Last updated in NVD database

Technical Details for CVE-2025-21354

Vulnerability Analysis

This vulnerability stems from an untrusted pointer dereference condition (CWE-822) within Microsoft Excel's file parsing functionality. When Excel processes a maliciously crafted spreadsheet file, the application fails to properly validate pointer references before dereferencing them. This allows an attacker to control memory addresses that Excel attempts to access, ultimately enabling arbitrary code execution.

The attack requires local access in the sense that a user must open a malicious file, though the file itself can be delivered remotely via email, web download, or file sharing platforms. No special privileges are required to exploit this vulnerability, but user interaction (opening the malicious file) is necessary for successful exploitation.

Root Cause

The root cause of CVE-2025-21354 is an untrusted pointer dereference vulnerability (CWE-822). This occurs when the application uses a pointer value from an untrusted source without proper validation. In the context of Excel file parsing, crafted data within a malicious spreadsheet can influence pointer values that the application subsequently dereferences, leading to memory corruption and code execution.

Attack Vector

The attack vector for this vulnerability is local, requiring user interaction to succeed. A typical attack scenario involves:

1. An attacker crafts a malicious Excel file (.xlsx, .xlsm, or other Excel-supported formats) containing specifically structured data designed to trigger the pointer dereference vulnerability
2. The file is delivered to the victim through phishing emails, malicious websites, or compromised file shares
3. When the victim opens the file in a vulnerable version of Microsoft Excel, the malicious payload executes
4. The attacker gains code execution with the privileges of the user running Excel

The vulnerability does not require the victim to enable macros or take additional actions beyond opening the malicious file. The exploitation occurs during the file parsing phase, making it particularly dangerous as it bypasses traditional macro-based security controls.

Detection Methods for CVE-2025-21354

Indicators of Compromise

• Unexpected crashes or abnormal behavior in Microsoft Excel processes (EXCEL.EXE)
• Suspicious child processes spawned by Excel, particularly command interpreters or PowerShell
• Unusual network connections initiated by Excel processes
• Excel files with anomalous internal structures or suspicious embedded objects

Detection Strategies

• Monitor for EXCEL.EXE spawning unexpected child processes such as cmd.exe, powershell.exe, or wscript.exe
• Implement endpoint detection rules for Excel processes attempting to access sensitive system resources
• Deploy file integrity monitoring on systems where Excel files are frequently accessed
• Utilize behavioral analysis to detect Excel processes performing atypical operations such as registry modifications or network connections

Monitoring Recommendations

• Enable enhanced logging for Microsoft Office applications via Windows Event Logging
• Configure SIEM rules to alert on Excel process anomalies and suspicious parent-child process relationships
• Implement network monitoring to detect unusual outbound connections from Office application processes
• Deploy SentinelOne agents with behavioral AI to detect exploitation attempts in real-time

How to Mitigate CVE-2025-21354

Immediate Actions Required

• Apply the latest security updates from Microsoft for all affected Office products immediately
• Enable Protected View for files originating from the internet or untrusted locations
• Implement Application Guard for Office to isolate potentially malicious documents
• Educate users about the risks of opening Excel files from unknown or untrusted sources

Patch Information

Microsoft has released security updates to address CVE-2025-21354. Administrators should apply the appropriate updates for their installed Office versions. Detailed patch information and download links are available in the Microsoft Security Update Guide.

For enterprise environments, patches can be deployed through Windows Update, Microsoft Update Catalog, or enterprise deployment tools such as WSUS and Configuration Manager. Microsoft 365 Apps subscribers will receive updates automatically through the standard update channels.

Workarounds

• Enable Protected View in Excel to open untrusted files in a sandboxed read-only mode
• Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes
• Use Application Guard for Office 365 to open files from untrusted sources in isolated containers
• Implement email filtering to block or quarantine suspicious Excel attachments before they reach end users

# Enable ASR rule to block Office applications from creating child processes
# Run in elevated PowerShell
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled