CVE-2025-32704: Microsoft 365 Apps RCE Vulnerability

CVE-2025-32704 Overview

CVE-2025-32704 is a buffer over-read vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw affects multiple Excel and Microsoft Office builds, including Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021 and 2024. Successful exploitation requires a local attack vector and low-privileged user interaction with a malicious spreadsheet. The vulnerability maps to [CWE-126] (Buffer Over-read) and [CWE-125] (Out-of-Bounds Read). Microsoft assigned the flaw a CVSS 3.1 score of 7.8 with impacts to confidentiality, integrity, and availability.

Critical Impact
Successful exploitation grants an attacker arbitrary code execution in the context of the user opening a crafted Excel document, enabling malware installation, credential theft, and lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Excel 2016 (x86 and x64)
Microsoft Office 2019 and Microsoft Office LTSC 2021 / 2024 (x86 and x64)

Discovery Timeline

2025-05-13 - CVE-2025-32704 published to the National Vulnerability Database
2025-05-13 - Microsoft released the CVE-2025-32704 security advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32704

Vulnerability Analysis

The vulnerability is a buffer over-read within the Microsoft Excel parsing logic. When Excel processes a specially crafted spreadsheet, it reads memory beyond the intended boundary of an allocated buffer. This out-of-bounds read can leak adjacent memory contents and, combined with the flawed parsing state, allows an attacker to steer program execution. Microsoft classifies the outcome as local code execution because the attacker must deliver a malicious file that the target opens.

The issue affects the parsing path shared across supported Excel builds, which is why the same CVE covers Microsoft 365 Apps, Excel 2016, Office 2019, and the Office LTSC channels. Execution occurs in the security context of the signed-in user, so an attacker who compromises a workstation account inherits its permissions on local files, shares, and cached credentials.

Root Cause

The root cause is improper validation of an input-derived length or offset used during Excel file parsing, resulting in a read past the end of an allocated buffer ([CWE-126]). The condition satisfies [CWE-125] (Out-of-Bounds Read) and, in this instance, corrupts internal state sufficiently to hand control flow to attacker-influenced data.

Attack Vector

Exploitation requires a local attack vector: the target must open a malicious .xlsx, .xlsm, .xls, or related Excel file. Delivery typically occurs through phishing emails, malicious links, USB media, or compromised file shares. No network authentication to Excel is required, but the user must interact with the file. Preview handlers and automatic file rendering can also trigger the parsing path in some configurations.

See the Microsoft CVE-2025-32704 Advisory for the vendor's technical description and update guidance.

Detection Methods for CVE-2025-32704

Indicators of Compromise

Excel processes (EXCEL.EXE) spawning unusual child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel writing executable content (.exe, .dll, .js, .hta, .ps1) to user-writable directories such as %TEMP%, %APPDATA%, or %PUBLIC%.
Unexpected outbound network connections initiated by EXCEL.EXE shortly after a document is opened.
Crash events or Watson reports referencing Excel modules following the open of an untrusted spreadsheet.

Detection Strategies

Hunt for parent-child process anomalies where EXCEL.EXE launches scripting or living-off-the-land binaries.
Correlate Office telemetry with endpoint identification events using an XDR platform to surface post-exploitation activity such as persistence keys, scheduled tasks, or LSASS access.
Inspect inbound email attachments and web downloads for Excel files with malformed records or oversized structures inconsistent with standard OOXML schemas.

Monitoring Recommendations

Enable Microsoft Defender attack surface reduction rules that block Office applications from creating child processes and from injecting code into other processes.
Forward Office, Sysmon, and EDR telemetry to a centralized data lake to enable behavioral hunting across endpoints.
Alert on Excel crashes occurring immediately after a document open, which frequently indicate exploitation attempts against parsing vulnerabilities.

How to Mitigate CVE-2025-32704

Immediate Actions Required

Apply the Microsoft security updates referenced in the CVE-2025-32704 advisory across all Excel and Office installations.
Prioritize patching for users who routinely open externally sourced spreadsheets, including finance, procurement, and executive assistants.
Verify that Protected View and Office Trust Center settings are enforced through Group Policy for files originating from the internet or email.

Patch Information

Microsoft published fixes concurrently with the May 13, 2025 disclosure. Administrators should deploy the corresponding cumulative updates for Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021 / 2024 (both x86 and x64 SKUs). Confirm patch levels using winver, Click-to-Run update history, or software inventory data, then validate remediation against the version numbers listed in the vendor advisory.

Workarounds

Enforce Protected View for files originating from the internet, Outlook attachments, and unsafe locations.
Block or restrict macros in Office documents sourced from the internet using Group Policy or Intune settings.
Use file-type filtering at the email gateway to quarantine or sandbox unexpected Excel attachments from external senders.
Restrict end-user permissions so that code executing in the Excel process context cannot install services or modify system-wide configuration.

bash

# Configuration example: enforce Protected View and block macros from the internet via registry
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f