CVE-2025-30381: Microsoft 365 Apps RCE Vulnerability

CVE-2025-30381 Overview

CVE-2025-30381 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel that enables local code execution. Attackers exploit the flaw by delivering a crafted Excel document and convincing a user to open it. Successful exploitation allows arbitrary code execution within the context of the current user. The vulnerability affects multiple Microsoft Office products, including Microsoft 365 Apps, Excel 2016, Office 2019, the Office Long Term Servicing Channel (2021 and 2024, including macOS builds), and Office Online Server. Microsoft published the advisory on May 13, 2025, and the entry was last updated in the National Vulnerability Database on May 19, 2025.

Critical Impact
An attacker can execute arbitrary code with the privileges of the user opening a malicious Excel file, leading to full compromise of confidentiality, integrity, and availability on the local host.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Excel 2016, Microsoft Office 2019
Microsoft Office Long Term Servicing Channel 2021 and 2024 (Windows and macOS), Microsoft Office Online Server

Discovery Timeline

2025-05-13 - CVE-2025-30381 published to NVD with Microsoft advisory
2025-05-19 - Last updated in NVD database

Technical Details for CVE-2025-30381

Vulnerability Analysis

The flaw is an out-of-bounds read [CWE-125] in the Excel file parsing logic. Excel reads memory outside the bounds of an allocated buffer when processing a malformed spreadsheet structure. The parser then uses that out-of-bounds data in subsequent operations, which corrupts internal program state. An attacker can shape the read primitive into arbitrary code execution by controlling adjacent memory contents. The exploitation requires user interaction, since the target must open the crafted document. The attack runs in the local security context of the user, so privileges inherited by the Excel process determine the immediate blast radius. Successful exploitation provides high impact to confidentiality, integrity, and availability of the affected host.

Root Cause

The root cause is missing or insufficient bounds checking on attacker-controlled length or offset fields inside an Excel document structure. When Excel parses these fields, it reads past the end of an allocated object, exposing adjacent memory or leading to memory corruption when the value is later dereferenced. Microsoft has not published the affected function names or file format component in the public advisory.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a weaponized .xlsx or .xls file through phishing, a removable drive, a file share, or a drive-by download. When the user opens the file in a vulnerable Excel build, the out-of-bounds read triggers and the embedded exploit chain executes code as the current user. The Preview Pane in some Office configurations may also process attacker-controlled content, expanding the trigger surface. No network authentication is required, and the attacker does not need prior access to the system.

No verified proof-of-concept exploit code is publicly available. See the Microsoft CVE-2025-30381 Advisory for vendor technical details.

Detection Methods for CVE-2025-30381

Indicators of Compromise

Excel (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, or mshta.exe.
Excel processes loading unsigned or unusual DLLs from user-writable paths such as %TEMP%, %APPDATA%, or Downloads.
Outbound network connections initiated directly by EXCEL.EXE to untrusted external hosts immediately after a document is opened.
Crash events or Windows Error Reporting telemetry referencing access violations in Excel during file open.

Detection Strategies

Hunt for Office process-tree anomalies where Excel is the parent of script interpreters or LOLBins shortly after a document-open event.
Inspect inbound email attachments and downloaded spreadsheets with sandboxing to surface exploit attempts before user delivery.
Correlate Excel crash telemetry with subsequent process creation or persistence activity on the same host within a short time window.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.
Forward Sysmon Event ID 1 (process create) and Event ID 11 (file create) for EXCEL.EXE to a central log platform for retrospective hunts.
Track Office build numbers across the fleet and alert when unpatched versions of Microsoft 365 Apps, Office 2019, or LTSC builds remain in production.

How to Mitigate CVE-2025-30381

Immediate Actions Required

Apply the May 2025 Microsoft security updates to all affected Office and Microsoft 365 Apps builds, prioritizing internet-exposed and high-value users.
Restrict execution of Excel files originating from email and the internet using Mark of the Web enforcement and Protected View.
Disable the Outlook and File Explorer Preview Pane for Office documents until patches are deployed across the fleet.
Block inbound .xls, .xlsm, and other legacy Excel formats at the mail gateway when business workflows allow.

Patch Information

Microsoft addressed CVE-2025-30381 in the May 13, 2025 security update cycle. Refer to the Microsoft CVE-2025-30381 Advisory for the specific update package and build numbers that apply to each channel, including Microsoft 365 Apps, Office 2019, Office LTSC 2021, Office LTSC 2024 (Windows and macOS), and Office Online Server. Microsoft 365 Apps installations should receive the fix automatically through Click-to-Run; verify the build number after update.

Workarounds

Enforce Protected View and Office File Block policy for files from the internet and untrusted locations until patching is complete.
Apply Attack Surface Reduction rules that block child process creation from Office applications across all managed endpoints.
Remove local administrator rights from standard users so a successful exploit runs with reduced privileges.

bash

# Configuration example: enable ASR rule to block Office child processes (PowerShell)
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify Microsoft 365 Apps build after patching
& "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user