CVE-2025-21390: Microsoft Excel RCE Vulnerability

CVE-2025-21390 Overview

CVE-2025-21390 is a remote code execution vulnerability in Microsoft Excel that allows attackers to execute arbitrary code on a target system. The flaw is rooted in a heap-based buffer overflow [CWE-122] triggered when Excel processes a maliciously crafted spreadsheet. Exploitation requires user interaction, typically by opening a weaponized .xlsx or .xls file delivered through phishing or shared file repositories.

The vulnerability affects Microsoft 365 Apps, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021 and 2024 (including macOS), and Microsoft Office Online Server. The attack vector is local, but successful exploitation grants the attacker code execution in the context of the current user.

Critical Impact
Attackers who convince a user to open a crafted Excel file gain code execution with the user's privileges, leading to data theft, lateral movement, or malware deployment.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Excel 2016, Microsoft Office 2019, and Microsoft Office LTSC 2021/2024 (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2025-02-11 - CVE-2025-21390 published to NVD and addressed in Microsoft's February 2025 Patch Tuesday
2025-07-01 - Last updated in NVD database

Technical Details for CVE-2025-21390

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in Microsoft Excel's file parsing logic. When Excel deserializes specific structures inside a malformed spreadsheet, it writes data beyond the bounds of a heap-allocated buffer. The overflow corrupts adjacent heap metadata and object pointers, which an attacker can shape to redirect execution flow.

The issue affects the desktop applications shipped with Microsoft 365 Apps, Office 2019, and the LTSC builds, as well as Office Online Server. Both x86 and x64 builds are impacted, and macOS variants of the LTSC channel are also listed in the affected configurations.

Root Cause

The root cause is improper validation of size or length fields within an Excel document structure before copying user-controlled data into a fixed-size heap buffer. Because the length value is attacker-controlled inside the file, the parser writes past the buffer boundary into adjacent heap memory.

Attack Vector

Exploitation requires the victim to open a malicious file. Common delivery methods include phishing email attachments, links to file shares, and documents hosted on collaboration platforms. The Preview Pane is not a vector for this CVE per Microsoft, but execution occurs as soon as the file is opened in a vulnerable Excel build.

The vulnerability does not require elevated privileges. Code executes with the rights of the logged-in user, which on many endpoints includes local administrator membership.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of the latest NVD update. See the Microsoft Security Update Guide for CVE-2025-21390 for vendor technical details.

Detection Methods for CVE-2025-21390

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe
Excel writing or executing files in %TEMP%, %APPDATA%, or %PROGRAMDATA% shortly after a document is opened
Outbound network connections initiated by EXCEL.EXE to untrusted external hosts
Crash events or Windows Error Reporting entries referencing EXCEL.EXE and heap corruption signatures

Detection Strategies

Hunt for process lineage where EXCEL.EXE is the parent of script interpreters or LOLBins commonly abused for payload staging
Inspect Office telemetry and Microsoft-Windows-Sysmon/Operational logs for image loads of unsigned DLLs into the Excel process
Correlate email gateway detections of macro-less Office exploit patterns with endpoint file-open events on the same host

Monitoring Recommendations

Enable and forward Sysmon process-creation, file-create, and network-connection events from Excel to a centralized SIEM
Track Office build numbers across the fleet to identify endpoints still running pre-February 2025 versions
Alert on Excel processes loading or dropping executables, especially when followed by persistence operations such as Run-key writes or scheduled task creation

How to Mitigate CVE-2025-21390

Immediate Actions Required

Apply the February 2025 Microsoft security updates to all affected Excel, Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office Online Server installations
Inventory endpoints to confirm patched build numbers and remediate stragglers, including macOS LTSC clients
Block inbound Office attachments from untrusted senders at the email gateway and enforce safe-attachment scanning

Patch Information

Microsoft released fixes for CVE-2025-21390 on February 11, 2025. Updates are delivered through Microsoft Update, the Microsoft 365 Apps update channels, and Click-to-Run for Office. Office Online Server requires the corresponding server-side security update. Refer to the Microsoft Security Update Guide for CVE-2025-21390 for build-specific package identifiers.

Workarounds

Enforce Protected View and Office Application Guard for files originating from the internet and email
Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from injecting code into other processes
Restrict Excel from opening files from untrusted locations using Group Policy file-block settings until patching is complete

bash

# Example: enable ASR rule "Block all Office applications from creating child processes"
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A \
                 -AttackSurfaceReductionRules_Actions Enabled