CVE-2025-27750: Microsoft 365 Apps Use-After-Free Flaw

CVE-2025-27750 Overview

CVE-2025-27750 is a use-after-free vulnerability [CWE-416] in Microsoft Office Excel that allows local code execution. An unauthorized attacker can execute arbitrary code on a victim system by enticing a user to open a specially crafted Excel document. The flaw affects Microsoft 365 Apps, Microsoft Excel 2016, Microsoft Office 2019, and Microsoft Office Long Term Servicing Channel (LTSC) 2021 and 2024 on both Windows and macOS. Microsoft published the advisory on April 8, 2025.

Critical Impact
Successful exploitation grants the attacker arbitrary code execution in the security context of the user running Excel, leading to full confidentiality, integrity, and availability compromise of the local session.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Excel 2016 and Microsoft Office 2019
Microsoft Office LTSC 2021 and 2024 (Windows and macOS)

Discovery Timeline

2025-04-08 - CVE-2025-27750 published to NVD
2025-04-08 - Microsoft releases security update via Microsoft Security Update CVE-2025-27750
2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-27750

Vulnerability Analysis

The flaw is a use-after-free condition [CWE-416] in the Microsoft Office Excel parsing and rendering engine. Excel references a heap object after that object has been freed, allowing an attacker who controls the freed memory to redirect execution. The issue requires user interaction: the target must open a malicious workbook delivered through email, web download, or a shared file location. Exploitation occurs locally in the context of the logged-in user.

Root Cause

The vulnerability stems from improper memory lifecycle management within Excel's object-handling code. A pointer to a heap-allocated structure remains in use after the object has been released, creating a dangling reference. When Excel later dereferences that pointer during document processing, the attacker-controlled replacement contents are treated as a valid object. Microsoft has not published structural details beyond the CWE-416 classification in its advisory.

Attack Vector

An attacker crafts a malicious .xlsx, .xlsm, or related Office document containing the trigger payload. The attacker delivers the file through phishing, a watering-hole site, or a malicious attachment. Once the user opens the document in a vulnerable Excel build, Excel parses the embedded structures, triggers the dangling pointer dereference, and executes attacker-controlled code. The Preview Pane is not listed by Microsoft as an attack vector for this CVE; full user-initiated open is required.

No public proof-of-concept exploit is currently available, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. The EPSS data indicates an elevated likelihood of exploitation relative to most CVEs, which is consistent with the historical exploitation pattern of Office memory-corruption bugs.

Detection Methods for CVE-2025-27750

Indicators of Compromise

Excel processes (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, mshta.exe, or wscript.exe.
Unsigned or unexpected DLLs loaded into the EXCEL.EXE process address space.
Outbound network connections initiated directly from EXCEL.EXE to unfamiliar hosts shortly after a document is opened.
New persistence artifacts (Run keys, scheduled tasks, startup folder items) created during or immediately after Excel execution.

Detection Strategies

Hunt for parent-child process anomalies where EXCEL.EXE is the parent of a scripting or LOLBin process.
Inspect Office documents arriving via email gateways for embedded objects, suspicious VBA, or malformed BIFF/OOXML structures.
Monitor for crash events of EXCEL.EXE in the Windows Application event log, which can indicate failed exploitation attempts.

Monitoring Recommendations

Centralize Office telemetry and endpoint process events in a SIEM or data lake for correlation across users.
Alert on writes by EXCEL.EXE to executable file paths, registry autorun locations, or scheduled task definitions.
Track file delivery chains (mail, web, USB) for Excel attachments and correlate with subsequent endpoint activity.

How to Mitigate CVE-2025-27750

Immediate Actions Required

Apply the April 2025 Microsoft security updates for all affected Office channels referenced in the Microsoft Security Update CVE-2025-27750 advisory.
Inventory endpoints for vulnerable Excel builds across Microsoft 365 Apps, Office 2016, Office 2019, and Office LTSC 2021/2024 on Windows and macOS.
Prioritize patching for users who routinely handle external Excel attachments, such as finance, procurement, and HR teams.

Patch Information

Microsoft has issued patches for all affected products. Administrators should consult the Microsoft Security Update CVE-2025-27750 guide for the specific build numbers and KB articles applicable to each channel, then deploy through Microsoft Update, WSUS, Intune, or Microsoft AutoUpdate for macOS.

Workarounds

Enforce Protected View and Office Application Guard for documents originating from the internet or email until patches are deployed.
Block or restrict macro execution from internet-sourced files using the Group Policy setting Block macros from running in Office files from the Internet.
Use Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from injecting code into other processes.
Train users to avoid opening unsolicited Excel attachments and to report suspicious files to the security team.

bash

# Enable ASR rules to block Office child process creation and code injection
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

Set-MpPreference -AttackSurfaceReductionRules_Ids `
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled