CVE-2025-21394: Microsoft Excel RCE Vulnerability

CVE-2025-21394 Overview

CVE-2025-21394 is a remote code execution vulnerability in Microsoft Excel rooted in a use-after-free flaw [CWE-416]. The issue affects Microsoft 365 Apps, Excel 2016, Office 2019, Office Long Term Servicing Channel 2021 and 2024, and Office Online Server. Despite the "Remote Code Execution" classification, the CVSS vector indicates a local attack vector requiring user interaction. An attacker crafts a malicious Office document and convinces a user to open it, triggering memory corruption that leads to arbitrary code execution in the context of the current user.

Critical Impact
Successful exploitation grants code execution with the privileges of the user opening the document, enabling malware installation, credential theft, and lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016, Microsoft Office 2019
Microsoft Office Long Term Servicing Channel 2021 and 2024 (Windows and macOS), Microsoft Office Online Server

Discovery Timeline

2025-02-11 - CVE-2025-21394 published to NVD
2025-07-01 - Last updated in NVD database

Technical Details for CVE-2025-21394

Vulnerability Analysis

The vulnerability is classified as a use-after-free condition [CWE-416] in Microsoft Excel's document parsing logic. Use-after-free flaws arise when a program continues to reference memory after it has been freed, allowing an attacker who controls the contents of that reallocated memory to influence program flow.

In the context of Excel, the dangling pointer can be triggered while parsing a specifically crafted spreadsheet object, formula, or embedded resource. When Excel later dereferences the freed object, attacker-supplied data is interpreted as a valid object, including virtual function pointers that redirect execution to attacker-controlled code.

Exploitation requires user interaction: the victim must open the malicious file. Code execution occurs in the context of the user, so an attacker who lands a payload on a privileged account gains corresponding access.

Root Cause

The root cause is improper object lifetime management within Excel's document processing routines. A reference to an object is retained after the underlying allocation is released, leaving a dangling pointer that subsequent operations dereference without validating the object's state.

Attack Vector

The attacker delivers a weaponized .xls, .xlsx, or related Office document through phishing email, file share, or malicious download. When the target opens the file, Excel parses the embedded structure that triggers the use-after-free condition, leading to control of the instruction pointer and execution of an embedded payload. The Preview Pane is not listed by Microsoft as an attack vector for this CVE.

No verified public exploit code is currently available. Refer to the Microsoft Security Update CVE-2025-21394 advisory for vendor-supplied technical context.

Detection Methods for CVE-2025-21394

Indicators of Compromise

Excel processes (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Office applications writing executable content (.exe, .dll, .scr) or scripts to user-writable paths like %TEMP%, %APPDATA%, or Downloads.
Outbound network connections initiated directly by EXCEL.EXE to unfamiliar domains or IP addresses shortly after a document opens.
Crash dumps or Windows Error Reporting events referencing access violations within Excel modules.

Detection Strategies

Hunt for parent-child process anomalies where Office binaries spawn script interpreters or LOLBins, which is a common post-exploitation pattern following document-based code execution.
Inspect inbound email gateways and file storage for Excel files containing unusual embedded objects, ActiveX controls, or macros, and detonate suspicious samples in a sandbox.
Correlate document-open events with subsequent process creation, file write, and network connection telemetry to surface the full attack chain.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting code into other processes, then forward audit events to a central log store.
Collect Sysmon Event IDs 1, 7, 11, and 3 from endpoints running Office, and retain them for retrospective hunting.
Alert on Office processes loading unsigned DLLs from user-writable directories.

How to Mitigate CVE-2025-21394

Immediate Actions Required

Apply the Microsoft February 2025 security updates that remediate CVE-2025-21394 across all affected Office and Microsoft 365 Apps channels.
Inventory endpoints to confirm patch deployment, including standalone Office 2016, 2019, LTSC 2021, and LTSC 2024 installations on Windows and macOS.
Restrict opening of Excel documents originating from untrusted sources, and enforce Mark-of-the-Web propagation so files retain their internet zone tag.

Patch Information

Microsoft has released security updates for all affected SKUs. See Microsoft Security Update CVE-2025-21394 for the per-product build numbers and download links. Microsoft 365 Apps update through the standard channel servicing model; ensure click-to-run clients are not blocked from receiving updates.

Workarounds

Where patching is delayed, configure Protected View and Office File Block policies to force untrusted Excel documents to open in a sandboxed, read-only mode.
Enable ASR rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A (block Office child processes) and 3B576869-A4EC-4529-8536-B80A7769E899 (block Office from creating executable content) in Block mode.
Disable legacy file formats and ActiveX controls through Group Policy where business workflows allow.

bash

# Example Group Policy registry settings to enforce Protected View and block legacy formats for Excel
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\FileBlock" /v XL97WorkbooksAndTemplates /t REG_DWORD /d 2 /f