CVE-2025-54898: Microsoft 365 Apps RCE Vulnerability

CVE-2025-54898 Overview

CVE-2025-54898 is an out-of-bounds read vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw is classified under [CWE-125] (Out-of-bounds Read) and affects multiple supported versions of Microsoft Office and Microsoft 365 Apps. Exploitation requires user interaction, typically through opening a specially crafted Excel file. Microsoft published the advisory on September 9, 2025.

Critical Impact
Successful exploitation enables an attacker to execute arbitrary code in the context of the current user, potentially leading to full compromise of the local user session and any data accessible to that account.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016, Microsoft Office 2019
Microsoft Office Long Term Servicing Channel 2021 and 2024 (Windows and macOS), Microsoft Office Online Server

Discovery Timeline

2025-09-09 - CVE-2025-54898 published to NVD
2025-09-12 - Last updated in NVD database

Technical Details for CVE-2025-54898

Vulnerability Analysis

The vulnerability is an out-of-bounds read condition within Microsoft Excel's file parsing logic. When Excel processes a malformed spreadsheet, the parser reads memory beyond the bounds of an allocated buffer. This out-of-bounds read can be combined with other primitives during file parsing to corrupt program state and redirect execution flow.

The issue affects both Windows and macOS distributions of Office Long Term Servicing Channel, as well as the cloud-rendered Office Online Server. Because the bug resides in shared Office parsing components, it spans the entire supported Office product family. Code execution occurs in the security context of the user opening the file, so accounts with administrative privileges expose the system to broader impact.

Root Cause

The root cause is improper validation of length or offset fields within an Excel document structure. The parser trusts attacker-controlled values when computing read offsets, allowing it to dereference memory outside the intended buffer. Microsoft has not published low-level technical details beyond the Microsoft Security Update CVE-2025-54898 advisory.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted Excel file through phishing email, malicious website download, a shared drive, or a collaboration platform. When the victim opens the file in a vulnerable Excel build, the parsing routine triggers the out-of-bounds read. Protected View and Mark-of-the-Web normally interrupt this chain, but users who click "Enable Editing" remove those barriers. No network exposure or authentication is required by the attacker; the attacker leverages the victim's own privileges.

No public proof-of-concept code has been released for this issue at the time of writing.

Detection Methods for CVE-2025-54898

Indicators of Compromise

Unexpected EXCEL.EXE child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel crashes (WerFault.exe events referencing EXCEL.EXE) shortly after opening attachments or downloaded .xls, .xlsx, .xlsm, or .xlsb files.
Outbound network connections initiated by EXCEL.EXE to previously unseen domains or IP addresses.
Creation of executable files or scripts in %TEMP%, %APPDATA%, or user profile directories following Excel activity.

Detection Strategies

Hunt for Office process lineage anomalies using behavioral analytics that flag Excel spawning script interpreters or LOLBins.
Inspect attachments with sandbox detonation to surface crafted Excel files that trigger parser exceptions or shellcode behavior.
Correlate Mark-of-the-Web file origin with subsequent process execution to identify documents bypassing Protected View.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block child process creation from Office applications and log audit events.
Forward Sysmon process creation, image load, and file creation events from endpoints running Office to a central SIEM for correlation.
Monitor Office telemetry for crash signatures and exception codes consistent with memory access violations in EXCEL.EXE.

How to Mitigate CVE-2025-54898

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2025-54898 advisory across all affected Office and Microsoft 365 Apps installations.
Verify update channels for Microsoft 365 Apps deliver the patched build to all endpoints, including macOS clients of Office LTSC 2021 and 2024.
Patch Microsoft Office Online Server instances, since server-side rendering also processes attacker-supplied Excel files.

Patch Information

Microsoft has released security updates addressing CVE-2025-54898 for all supported affected products. Administrators should reference the Microsoft Security Update CVE-2025-54898 advisory for the specific build numbers per channel and deploy through Microsoft Update, Microsoft 365 Apps admin center, WSUS, or Intune.

Workarounds

Enforce Protected View and Block Macros from the Internet via Group Policy to limit execution of untrusted Excel files.
Enable Microsoft Defender ASR rule "Block all Office applications from creating child processes" to break common post-exploitation chains.
Restrict inbound Excel attachments at the email gateway and require sandbox analysis for files from external senders.
Educate users to avoid clicking "Enable Editing" on Excel files originating from email, chat, or untrusted web downloads.

bash

# Configuration example: Enable ASR rule to block Office child processes (PowerShell)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A \
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify configuration
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids