CVE-2025-48812: Microsoft 365 Apps Information Disclosure

CVE-2025-48812 Overview

CVE-2025-48812 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel. An attacker who crafts a malicious spreadsheet can read memory outside the allocated buffer when a user opens the file. This condition enables local information disclosure without any authentication. Exploitation requires user interaction, specifically opening the weaponized document in a vulnerable Excel client.

The flaw affects widely deployed Office builds, including Microsoft 365 Apps, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office Long Term Servicing Channel (LTSC) 2021 and 2024, and Microsoft Office Online Server. Microsoft addressed the issue through its Security Update Guide.

Critical Impact
A crafted Excel file can leak sensitive process memory contents to a local attacker, potentially exposing data useful for chaining with further exploits.

Affected Products

Microsoft 365 Apps (x64 and x86 enterprise builds)
Microsoft Excel 2016, Microsoft Office 2019
Microsoft Office LTSC 2021 and 2024 (Windows and macOS), Microsoft Office Online Server

Discovery Timeline

2025-07-08 - CVE-2025-48812 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48812

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] triggered when Excel parses a crafted spreadsheet. Excel reads bytes past the end of an allocated buffer while processing structured content within the file. The out-of-bounds bytes are then incorporated into program state accessible to the attacker's controlled document.

Because the attack surface is a local file opened by a user, an attacker must deliver the file through email, download, or a shared drive. Once opened, the malformed structure causes Excel to dereference memory beyond the intended boundary. The result is information disclosure rather than code execution or data tampering.

The impact is confined to confidentiality. Attackers can use leaked bytes to bypass mitigations such as Address Space Layout Randomization (ASLR) or to harvest sensitive strings held in the Excel process. Chaining this primitive with a memory-corruption vulnerability could improve exploit reliability.

Root Cause

The root cause is missing or incorrect bounds validation when Excel deserializes a specific record or object within a spreadsheet file. Excel calculates or trusts a length value from the file and reads beyond the buffer without confirming the read stays within allocated memory.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious .xls, .xlsx, or related Excel file and delivers it to the victim. When the user opens the file in a vulnerable Excel client, the parser triggers the out-of-bounds read and exposes memory contents.

No verified public proof-of-concept code is available at this time. See the Microsoft Security Update Guide entry for CVE-2025-48812 for vendor-provided technical context.

Detection Methods for CVE-2025-48812

Indicators of Compromise

Excel process (EXCEL.EXE) opening spreadsheet files delivered from external email attachments or untrusted download locations.
Excel crashes, Windows Error Reporting (WER) entries, or Application Event Log faults referencing access violations in Excel modules shortly after opening a document.
Unusual child processes or network connections spawned by EXCEL.EXE following the opening of an untrusted spreadsheet.

Detection Strategies

Inspect inbound email attachments and downloaded files for Excel documents with malformed record structures using a sandbox or dedicated file-parsing scanner.
Correlate document-open events with subsequent Excel exceptions, memory faults, or telemetry indicating anomalous read patterns.
Hunt for endpoints running unpatched Office builds enumerated in the affected products list, then prioritize based on user exposure to external documents.

Monitoring Recommendations

Enable Microsoft Office telemetry and forward Application and Security event logs to a centralized log platform for correlation.
Monitor for spikes in Excel crashes across the fleet, which can indicate active exploitation attempts against document parsers.
Track patch compliance for Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office Online Server against the current Microsoft update baseline.

How to Mitigate CVE-2025-48812

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-48812 to all affected Office installations.
Prioritize workstations belonging to users who routinely open external spreadsheets, including finance, procurement, and executive support roles.
Verify Office Online Server deployments receive the corresponding server-side update to close the shared parsing surface.

Patch Information

Microsoft has released fixes through the Microsoft Update channel for Microsoft 365 Apps, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft Office Online Server. Consult the Microsoft Security Update Guide entry for CVE-2025-48812 for the exact build numbers and download links applicable to each product channel.

Workarounds

Enable Protected View and Office Application Guard so that untrusted spreadsheets open in an isolated container by default.
Block or quarantine Excel attachments from external senders at the mail gateway until patches are fully deployed.
Use Attack Surface Reduction (ASR) rules to restrict Excel from launching child processes and to limit exposure if the read primitive is chained with other techniques.

bash

# Configuration example: enable ASR rule blocking Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled