CVE-2025-54896: Microsoft 365 Apps Use-After-Free Flaw

CVE-2025-54896 Overview

CVE-2025-54896 is a use-after-free vulnerability [CWE-416] in Microsoft Office Excel. An unauthorized attacker can exploit it to execute arbitrary code locally on a vulnerable system. The flaw affects multiple Microsoft Office product lines, including Microsoft 365 Apps, Excel 2016, Office 2019, Office Long Term Servicing Channel (LTSC) 2021 and 2024, and Office Online Server. Exploitation requires user interaction, typically by opening a crafted Excel document. Successful exploitation yields code execution in the context of the current user.

Critical Impact

Opening a malicious Excel file allows attackers to execute arbitrary code with the privileges of the logged-on user, enabling persistence, credential theft, or lateral movement.

Affected Products

• Microsoft 365 Apps (Enterprise x64 and x86)
• Microsoft Excel 2016, Microsoft Office 2019
• Microsoft Office LTSC 2021 and 2024 (Windows and macOS), Microsoft Office Online Server

Discovery Timeline

• 2025-09-09 - CVE-2025-54896 published to NVD
• 2025-09-12 - Last updated in NVD database

Technical Details for CVE-2025-54896

Vulnerability Analysis

The vulnerability is a use-after-free condition within Microsoft Office Excel. A use-after-free occurs when an application continues to reference a memory object after it has been freed. When Excel parses a malformed spreadsheet, the affected code path releases an internal object but retains a dangling pointer. Subsequent operations dereference that pointer, which an attacker can groom to point at attacker-controlled memory. The result is hijacked control flow inside the Excel process.

Because the attack vector is local and requires user interaction, an attacker must deliver the crafted file and convince the target to open it. Common delivery channels include phishing email attachments, malicious cloud document links, and drive-by downloads. The Preview Pane can also act as an exploitation surface for Office formats.

Root Cause

The defect resides in Excel's object lifetime management for specific spreadsheet structures. The component frees an object during processing but does not clear or invalidate all references to it. The freed memory can then be reallocated and populated with attacker-controlled data, allowing the dangling reference to be reused as an arbitrary read or write primitive.

Attack Vector

An attacker crafts an Excel file containing the malformed structure that triggers the dangling reference. Delivery commonly relies on social engineering. When the victim opens the file, Excel parses the content, frees the vulnerable object, and reuses the stale pointer. The attacker chains this primitive with heap grooming and an ASLR bypass to achieve arbitrary code execution in the user's security context.

No public proof-of-concept or in-the-wild exploitation has been reported. See the Microsoft Security Advisory CVE-2025-54896 for vendor technical context.

Detection Methods for CVE-2025-54896

Indicators of Compromise

• Unexpected child processes spawned by excel.exe, such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
• Excel writing executable content (.exe, .dll, .scr) or scripts to user-writable paths such as %TEMP%, %APPDATA%, or %LOCALAPPDATA%.
• Excel process crashes or Watson dumps referencing access violations during file open, particularly with malformed .xls or .xlsx content.
• Outbound network connections initiated by excel.exe to uncategorized or newly registered domains shortly after document open.

Detection Strategies

• Hunt for Microsoft Office binaries spawning interpreters or LOLBins using EDR process telemetry mapped to MITRE ATT&CK T1566.001 and T1204.002.
• Inspect inbound email attachments for Excel files arriving from external senders, especially those containing macros, embedded OLE objects, or unusual binary streams.
• Correlate Excel crash events from Windows Error Reporting with subsequent suspicious process or file activity on the same host.

Monitoring Recommendations

• Enable and forward Microsoft Defender or equivalent EDR telemetry, including process creation, image load, and file write events for Office processes.
• Deploy Singularity Endpoint to apply behavioral AI against Office process lineage and identify post-exploitation activity such as code injection or credential access.
• Ingest endpoint, email gateway, and proxy logs into Singularity Data Lake to correlate document delivery with downstream exploitation indicators.

How to Mitigate CVE-2025-54896

Immediate Actions Required

• Apply the September 2025 Microsoft Office security updates referenced in the Microsoft Security Advisory CVE-2025-54896 to all affected Office installations.
• Inventory endpoints running Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021/2024 to confirm patch coverage on Windows and macOS hosts.
• Block or quarantine Excel attachments from external senders at the email gateway pending patch deployment.

Patch Information

Microsoft has released security updates for all affected SKUs. Administrators should deploy the latest cumulative updates through Microsoft Update, Microsoft 365 Apps Click-to-Run channels, WSUS, or Intune. Office Online Server requires the corresponding server-side update. Confirm patch level using the build numbers documented in the vendor advisory.

Workarounds

• Disable the Outlook Preview Pane and Windows Explorer Preview Pane for Office formats to reduce passive exploitation surface.
• Open untrusted Excel documents in Protected View and block macros from running in files originating from the internet via Group Policy.
• Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.

# Enforce ASR rules that limit Office child process and code injection abuse
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

Set-MpPreference -AttackSurfaceReductionRules_Ids `
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled