CVE-2025-29979 Overview
CVE-2025-29979 is a heap-based buffer overflow in Microsoft Office Excel that allows an unauthorized attacker to execute arbitrary code locally. The flaw is tracked under [CWE-122] (Heap-based Buffer Overflow) and [CWE-787] (Out-of-bounds Write). Successful exploitation requires user interaction, typically opening a malicious Excel file. The vulnerability affects multiple Microsoft Office distributions including Microsoft 365 Apps, Office 2019, Office Long Term Servicing Channel 2021 and 2024, and Office Online Server.
Critical Impact
Attackers can achieve local code execution in the context of the current user by delivering a crafted Excel document, leading to full compromise of confidentiality, integrity, and availability.
Affected Products
- Microsoft 365 Apps (Enterprise)
- Microsoft Excel 2016 and Microsoft Office 2019
- Microsoft Office Long Term Servicing Channel 2021 and 2024 (Windows and macOS), Microsoft Office Online Server
Discovery Timeline
- 2025-05-13 - CVE-2025-29979 published to NVD
- 2025-05-19 - Last updated in NVD database
Technical Details for CVE-2025-29979
Vulnerability Analysis
The vulnerability is a heap-based buffer overflow in the Excel parsing path. When Excel processes a malformed spreadsheet, it writes data past the bounds of a heap-allocated buffer. This corrupts adjacent heap metadata or object pointers, enabling an attacker to redirect execution flow.
The EPSS probability is 0.742% with a percentile of 73.375, indicating elevated exploitation likelihood relative to most CVEs. No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Root Cause
The root cause is improper bounds checking in Excel's document parser when handling structured spreadsheet content. A specifically crafted record causes the parser to allocate an undersized heap buffer or to miscalculate the destination size during a copy operation. The resulting out-of-bounds write ([CWE-787]) corrupts heap memory used by Excel's internal objects.
Attack Vector
Exploitation is local and requires user interaction. An attacker delivers a malicious .xlsx, .xls, or related Office file through email, a file share, or a web download. When the target opens the document in a vulnerable Excel version, the parser triggers the overflow and the attacker's payload executes with the privileges of the logged-on user. Preview Pane rendering may also be a viable trigger surface for Office documents.
No verified exploit code is publicly available. Refer to the Microsoft Security Update Guide CVE-2025-29979 for vendor details.
Detection Methods for CVE-2025-29979
Indicators of Compromise
- Excel (EXCEL.EXE) spawning unusual child processes such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
- Excel processes performing network connections to unfamiliar external hosts shortly after opening a document.
- Office documents arriving from untrusted senders containing embedded objects or unusually large record streams.
- Crash events or Watson reports referencing heap corruption in Excel modules.
Detection Strategies
- Monitor parent-child process relationships where EXCEL.EXE launches scripting interpreters or LOLBins.
- Alert on Excel writing executable content (.exe, .dll, .ps1) to disk in user-writable paths such as %TEMP% or %APPDATA%.
- Inspect inbound mail attachments and downloads for malformed Office files using sandbox detonation.
Monitoring Recommendations
- Forward Microsoft-Windows-Sysmon and Microsoft Defender telemetry to a centralized SIEM for correlation.
- Track Office application crashes via Windows Error Reporting to identify exploitation attempts.
- Enable Microsoft 365 audit logging and review access to sensitive file shares hosting Office documents.
How to Mitigate CVE-2025-29979
Immediate Actions Required
- Apply the May 2025 Microsoft security updates referenced in the Microsoft Security Update Guide CVE-2025-29979 to all affected Office installations.
- Inventory endpoints running Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office Online Server, and prioritize patching for high-risk users.
- Block inbound Office documents from untrusted external senders at the email gateway until patches are deployed.
Patch Information
Microsoft has released security updates addressing CVE-2025-29979 across all affected Office channels. Administrators should deploy updates via Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Intune. Click-to-Run installations of Microsoft 365 Apps update automatically once the new build is released to the configured channel. Consult the Microsoft Security Update Guide CVE-2025-29979 for the specific build numbers per product.
Workarounds
- Enable Protected View and Office Application Guard so untrusted documents open in an isolated container.
- Disable the Outlook Preview Pane and File Explorer preview handlers for Office files until patching completes.
- Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from injecting code into other processes.
# Enable ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A \
-AttackSurfaceReductionRules_Actions Enabled
# Enable ASR rule: Block Office applications from injecting code into other processes
Add-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 \
-AttackSurfaceReductionRules_Actions Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
