CVE-2025-53759: Microsoft 365 Apps RCE Vulnerability

CVE-2025-53759 Overview

CVE-2025-53759 is a local code execution vulnerability in Microsoft Office Excel caused by the use of an uninitialized resource [CWE-908]. An attacker who crafts a malicious spreadsheet can trigger the flaw when a user opens the file, executing arbitrary code in the context of the current user. The issue affects Microsoft 365 Apps, Microsoft Office 2019, Microsoft Office Long Term Servicing Channel (LTSC) 2021 and 2024, and Microsoft Office Online Server. Microsoft published the advisory on August 12, 2025.

Critical Impact
Successful exploitation grants an attacker code execution with the privileges of the logged-on user, enabling data theft, persistence, and lateral movement from an Office endpoint.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2019 and Office LTSC 2021 / 2024 (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2025-08-12 - CVE-2025-53759 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53759

Vulnerability Analysis

The flaw is an uninitialized resource use inside Microsoft Excel's file-parsing code. When Excel processes a specifically crafted workbook, it reads from a variable or memory buffer that was never initialized with a defined value. That stale or attacker-influenced memory is then used in logic that drives control flow or object dereferences.

Because the value is not deterministic, the vulnerability class typically enables an attacker to steer execution once heap layout is groomed. Microsoft classifies the outcome as local code execution requiring user interaction, consistent with a document-based delivery model where the victim opens a malicious .xlsx, .xls, or related Office format. Confidentiality, integrity, and availability are all impacted at the user's privilege level.

Root Cause

The root cause is a failure to initialize a resource before use [CWE-908]. Structured fields inside an Excel workbook can trigger a code path that consumes an object, pointer, or numeric field prior to it being populated by the parser. Attackers craft record streams that reach the uninitialized code path deterministically.

Attack Vector

Exploitation requires local file handling and user interaction. Attackers deliver the malicious workbook through phishing, watering-hole downloads, SMB shares, or Office Online Server ingest. Once the target opens the document, Excel parses the malicious structures and the uninitialized resource is used, yielding arbitrary code execution. No verified public exploit or CISA KEV entry exists at the time of writing.

The vulnerability is described in prose only. See the Microsoft Security Response Center advisory for CVE-2025-53759 for vendor technical guidance.

Detection Methods for CVE-2025-53759

Indicators of Compromise

Excel (EXCEL.EXE) spawning child processes such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe shortly after opening an attachment.
Unusual writes by Office processes into user-writable persistence locations, including %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup and Run registry keys.
Inbound spreadsheets from untrusted senders bearing macros, embedded OLE objects, or malformed BIFF/OOXML records.

Detection Strategies

Hunt for anomalous EXCEL.EXE process trees, especially spawning script interpreters or LOLBins.
Correlate Office telemetry with outbound network connections initiated by Excel to non-Microsoft destinations.
Inspect email gateway and web proxy logs for spreadsheet delivery patterns that match phishing tradecraft observed against your organization.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office child process creation and log the events centrally.
Ingest Sysmon Event IDs 1, 3, 7, and 11 from endpoints running Office, and alert on Excel-originated activity outside normal user behavior.
Track patch state across all Microsoft 365 Apps, Office 2019, and LTSC 2021/2024 installations to confirm remediation coverage.

How to Mitigate CVE-2025-53759

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-53759 across all affected Office SKUs.
Verify Microsoft 365 Apps update channels are current and force update on lagging endpoints and virtual desktop images.
Reinforce user awareness on opening unsolicited spreadsheet attachments, particularly from external senders.

Patch Information

Microsoft released fixes for CVE-2025-53759 through the August 2025 Patch Tuesday cycle. Administrators should deploy the platform-specific updates for Microsoft 365 Apps, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office Online Server as documented in the vendor advisory. macOS builds of Office LTSC also require the corresponding Microsoft AutoUpdate package.

Workarounds

Enable Protected View and Office Application Guard for documents originating from the internet or untrusted network locations.
Enforce Mark-of-the-Web propagation so that spreadsheets downloaded from email or the web open in Protected View by default.
Restrict Excel from spawning child processes using ASR rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A where operational testing allows.

bash

# Configuration example: enable ASR rule blocking Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled