CVE-2025-21362: Microsoft Excel RCE Vulnerability

CVE-2025-21362 Overview

CVE-2025-21362 is a remote code execution vulnerability in Microsoft Excel rooted in a use-after-free condition [CWE-416]. An attacker who successfully exploits this flaw can run arbitrary code in the context of the current user. Microsoft published the advisory on January 14, 2025, covering Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021 and 2024, and Office Online Server.

The attack vector is local, requiring the user to open a crafted Excel file. The Preview Pane is listed as an attack surface, meaning code execution can occur without the victim explicitly opening the document. No authentication or user interaction beyond rendering the file is required.

Critical Impact

Successful exploitation grants arbitrary code execution with the rights of the logged-on user, enabling installation of programs, data theft, and account takeover.

Affected Products

• Microsoft 365 Apps for Enterprise (x86 and x64)
• Microsoft Excel 2016, Microsoft Office 2019
• Microsoft Office LTSC 2021 and 2024 (Windows and macOS), Microsoft Office Online Server

Discovery Timeline

• 2025-01-14 - CVE-2025-21362 published to NVD with Microsoft advisory
• 2025-07-01 - Last updated in NVD database

Technical Details for CVE-2025-21362

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in Microsoft Excel's document parsing logic. Excel frees a memory object during processing of a malformed spreadsheet, then later dereferences the dangling pointer. Attackers control the contents written to the freed region before reuse, leading to arbitrary code execution.

Microsoft classifies the attack vector as local because the malicious file must reach the target system. However, the Preview Pane in Windows Explorer and Outlook can trigger the parsing code path. A user simply selecting the file in Explorer is sufficient to execute the exploit payload.

The resulting code runs with the privileges of the current user. On systems where users operate with administrative rights, the impact extends to full system compromise. The EPSS score sits at 0.631%, placing this issue in the 70th percentile for exploitation likelihood.

Root Cause

The defect resides in Excel's handling of object lifetimes during deserialization of structured spreadsheet content. A specific sequence of records causes the application to release a heap object while another code path retains a reference. When that reference is followed, attacker-controlled data drives subsequent virtual function dispatch.

Attack Vector

Delivery typically occurs through phishing email with an attached .xlsx or .xls file. Watering-hole sites and shared file repositories are alternative delivery channels. Because the Preview Pane is an attack surface, traditional advice to avoid opening attachments is insufficient.

The vulnerability manifests when Excel parses crafted records and reuses a freed object. See the Microsoft Security Update Guide for vendor technical details. No public proof-of-concept code has been published.

Detection Methods for CVE-2025-21362

Indicators of Compromise

• Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
• Office processes writing executable content to %TEMP%, %APPDATA%, or %PROGRAMDATA% directories.
• Outbound network connections initiated directly by EXCEL.EXE to previously unseen domains shortly after a file is opened or previewed.

Detection Strategies

• Hunt for Excel process trees that deviate from baseline by correlating parent-child relationships with command-line arguments.
• Inspect inbound email attachments and SharePoint uploads for Excel files containing unusual OLE streams, embedded objects, or malformed BIFF records.
• Monitor for memory-corruption telemetry such as exception events in EXCEL.EXE followed by suspicious thread creation.

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and writing executables.
• Forward Sysmon Event IDs 1, 7, 10, and 11 from endpoints running Office to a central SIEM for behavioral correlation.
• Track Outlook and Explorer Preview Pane activity preceding anomalous Excel behavior to identify zero-click exploitation attempts.

How to Mitigate CVE-2025-21362

Immediate Actions Required

• Apply the January 2025 Microsoft security updates for all affected Office and Microsoft 365 Apps channels without delay.
• Inventory endpoints with vulnerable versions of Excel, Office 2019, Office LTSC 2021/2024, and Office Online Server, prioritizing internet-facing and high-privilege users.
• Disable the Preview Pane in Outlook and Windows Explorer until patches are deployed.

Patch Information

Microsoft released fixes through the standard Office update channels on January 14, 2025. Refer to the Microsoft Security Update Guide for CVE-2025-21362 for build numbers per channel. Microsoft 365 Apps users on Current Channel receive updates automatically when click-to-run is enabled.

Workarounds

• Configure Protected View to open all files from the internet and untrusted locations in an isolated sandbox.
• Block macro execution in files from the internet through the Block macros from running in Office files from the Internet Group Policy setting.
• Restrict delivery of Excel attachments at the mail gateway and enforce safe-attachment detonation for inbound .xlsx, .xls, and .xlsm files.

# Disable Outlook Preview Pane via registry (per-user)
reg add "HKCU\Software\Microsoft\Office\16.0\Outlook\Options" /v DisableReadingPaneHomePage /t REG_DWORD /d 1 /f

# Enforce Protected View for files from the internet
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f