CVE-2025-29977: Microsoft 365 Apps Use-After-Free Flaw

CVE-2025-29977 Overview

CVE-2025-29977 is a use-after-free vulnerability in Microsoft Office Excel that enables local code execution. An attacker who convinces a user to open a crafted Excel workbook can execute arbitrary code in the context of the current user. The flaw is tracked under CWE-416: Use After Free and affects multiple supported Office release channels, including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office Online Server. Microsoft published guidance in the Microsoft Security Update Guide.

Critical Impact
Successful exploitation grants the attacker code execution with the privileges of the targeted user, leading to full compromise of confidentiality, integrity, and availability on the host.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Excel 2016, Microsoft Office 2019
Microsoft Office LTSC 2021 and 2024 (Windows and macOS), Microsoft Office Online Server

Discovery Timeline

2025-05-13 - CVE-2025-29977 published to NVD
2025-05-13 - Microsoft releases security guidance via the Microsoft Security Update Guide
2025-05-19 - Last updated in NVD database

Technical Details for CVE-2025-29977

Vulnerability Analysis

The vulnerability is a use-after-free condition inside Microsoft Excel's document parsing and rendering logic. Excel allocates an object during workbook processing, frees the underlying memory, and then later dereferences a stale pointer to that object. When the freed memory is reclaimed by attacker-controlled data, the dangling reference yields control over a function pointer, vtable entry, or object field used by Excel.

Exploitation requires user interaction. The victim must open or preview a malicious .xls, .xlsx, or related Excel file delivered through phishing, file shares, or a watering-hole site. The attacker does not need prior authentication on the target machine, and the resulting code runs with the privileges of the user who opened the file.

The EPSS score is 0.742% (73rd percentile), and no public exploit or CISA KEV listing is currently associated with the CVE.

Root Cause

The defect is a CWE-416 class issue: Excel retains a reference to an object whose memory has already been released, typically due to incorrect object lifetime management across parsing callbacks, COM/OLE handlers, or event sinks. When the stale reference is reused, the heap region may contain attacker-controlled bytes that hijack execution flow.

Attack Vector

The attack vector is local and requires user interaction. A typical chain begins with social engineering: the attacker emails a weaponized spreadsheet that triggers the freed-object reuse during parsing. Heap grooming, often combined with embedded objects or scripting features, places controlled data in the freed slot. Excel then dereferences the stale pointer, transferring execution to attacker-supplied code without prompting for additional privileges.

No verified public proof-of-concept code is available. Refer to the Microsoft Security Update Guide for vendor-supplied technical context.

Detection Methods for CVE-2025-29977

Indicators of Compromise

Excel spawning unusual child processes such as cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, or mshta.exe shortly after a document is opened.
Unexpected outbound network connections initiated by EXCEL.EXE, particularly to newly registered or low-reputation domains.
Crash dumps or Windows Error Reporting (WER) entries for EXCEL.EXE referencing access violations in heap-related modules.
Excel writing executable content (.exe, .dll, .js, .ps1) to user-writable locations such as %TEMP%, %APPDATA%, or Downloads.

Detection Strategies

Hunt for parent-child process relationships where EXCEL.EXE launches scripting interpreters or LOLBins, then performs network or persistence activity.
Correlate email gateway telemetry on inbound spreadsheet attachments with endpoint open events to identify suspicious delivery chains.
Inspect Office telemetry and Application crash logs (Event ID 1000) for repeated faults in Excel across multiple users opening similar files.

Monitoring Recommendations

Enable and forward Microsoft Defender Antivirus, AMSI, and Office cloud-based protection logs to a centralized SIEM for cross-host correlation.
Monitor for the creation of Office persistence artifacts such as new add-ins, COM handlers, or scheduled tasks created within minutes of a workbook opening.
Track Office Protected View bypass attempts and Mark-of-the-Web removal events on inbound spreadsheets.

How to Mitigate CVE-2025-29977

Immediate Actions Required

Apply the May 2025 Microsoft Office security updates referenced in the Microsoft Security Update Guide to all affected channels, including Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024.
Verify that Office Online Server hosts and macOS Office installations are patched, since both platforms are listed as affected.
Block inbound Excel attachments from untrusted senders at the email gateway until patch deployment is confirmed across the estate.

Patch Information

Microsoft addressed CVE-2025-29977 in the May 13, 2025 security update cycle. Administrators should use the Microsoft Security Update Guide to identify the specific KB and Click-to-Run build for each affected SKU and confirm deployment via Microsoft Intune, WSUS, SCCM, or the Office Deployment Tool.

Workarounds

Enforce Protected View and Office Application Guard for files originating from the internet and email attachments.
Disable or restrict legacy Excel features such as DDE, XLM macros, and untrusted external content where business workflows permit.
Apply Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from writing executable content.

bash

# Configuration example: enable Microsoft Defender ASR rules via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A, `
  3B576869-A4EC-4529-8536-B80A7769E899, `
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled, Enabled, Enabled