CVE-2025-30375: Microsoft 365 Apps RCE Vulnerability

CVE-2025-30375 Overview

CVE-2025-30375 is a type confusion vulnerability [CWE-843] in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw exists in how Excel accesses a resource using an incompatible type, leading to memory corruption when a crafted spreadsheet is opened. Exploitation requires user interaction, typically opening a malicious Excel file delivered through email or a web download. Successful exploitation yields code execution in the context of the user running Excel, threatening confidentiality, integrity, and availability of the host. Microsoft published the advisory on May 13, 2025.

Critical Impact
A crafted Excel document can trigger type confusion in the Excel parser, granting an attacker arbitrary code execution under the current user account.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Excel 2016 and Microsoft Office 2019
Microsoft Office Long Term Servicing Channel 2021 and 2024 (Windows and macOS), Microsoft Office Online Server

Discovery Timeline

2025-05-13 - CVE-2025-30375 published to NVD with Microsoft advisory
2025-05-19 - Last updated in NVD database

Technical Details for CVE-2025-30375

Vulnerability Analysis

The vulnerability is classified as type confusion [CWE-843], where Excel accesses an object using a type that does not match the object's actual layout. When Excel parses a malformed structure inside a spreadsheet file, it interprets memory belonging to one object type as another, mismatched type. This mismatch allows attacker-controlled fields to be treated as pointers, function tables, or size values. The result is memory corruption that can be steered into a controlled write or indirect call.

The attack vector is local and requires user interaction, meaning the victim must open the malicious file. Office macros are not required because the parser flaw triggers before any document logic executes. Code runs at the privilege level of the user account, which is sufficient for credential theft, ransomware staging, or lateral movement.

Root Cause

The root cause is improper validation of object type metadata within an Excel file format structure. Excel dispatches operations based on an embedded type identifier without confirming that the underlying object matches that identifier. An attacker who supplies inconsistent type fields forces the parser to operate on an object using methods or field offsets defined for a different class.

Attack Vector

An attacker crafts a malicious .xls, .xlsx, or related Excel file and delivers it through phishing, a shared drive, or a website. When the victim opens the file in a vulnerable Excel client, the type confusion fires during parsing and yields arbitrary code execution. Protected View provides partial mitigation only if the file is recognized as originating from an untrusted location and the user does not click Enable Editing. Refer to the Microsoft Security Update CVE-2025-30375 for vendor technical context.

Detection Methods for CVE-2025-30375

Indicators of Compromise

Excel process (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe shortly after a document open event.
Unusual outbound network connections initiated by EXCEL.EXE to attacker infrastructure following the opening of an emailed or downloaded spreadsheet.
Crashes or Watson reports referencing Excel modules immediately after opening files marked with the Mark-of-the-Web.

Detection Strategies

Hunt for Office-application process lineages where Excel is the parent of script interpreters, LOLBins, or unsigned binaries written to user-writable paths.
Inspect inbound email attachments and downloaded files for Excel documents with malformed BIFF/OOXML structures or embedded objects that deviate from schema.
Correlate Mark-of-the-Web tagged spreadsheets with subsequent file writes to %APPDATA%, %TEMP%, or autorun locations.

Monitoring Recommendations

Enable and forward Sysmon process creation, image load, and network connection events for all Office applications to a central analytics platform.
Monitor Microsoft Defender ASR rule telemetry, particularly rules blocking Office child process creation and Win32 API calls from Office macros.
Track patch compliance for Microsoft 365 Apps, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office Online Server across the estate.

How to Mitigate CVE-2025-30375

Immediate Actions Required

Apply the Microsoft May 2025 security updates to all affected Excel and Office installations as referenced in the Microsoft Security Update CVE-2025-30375.
Enforce Protected View and Office Protected View for files originating from the Internet, email attachments, and unsafe locations.
Block inbound Excel attachments from untrusted senders at the secure email gateway until patching is verified across endpoints.

Patch Information

Microsoft has released fixes covered by the advisory at Microsoft Security Update CVE-2025-30375. Updates are distributed through Microsoft Update, the Microsoft 365 Apps update channels, and the Office Deployment Tool. Office Online Server requires its respective server-side update package.

Workarounds

Enable Microsoft Defender Attack Surface Reduction rules to block Office applications from creating child processes and injecting into other processes.
Configure Group Policy to disallow opening files from untrusted locations in Excel and to keep Protected View enforced for Outlook attachments and Internet-origin files.
Restrict end-user permissions so that code executing as the current user cannot install services, modify autoruns, or write to system directories.

bash

# Configuration example: enforce ASR rule blocking Office child processes (GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A)
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled