CVE-2025-54899: Microsoft 365 Apps Use-After-Free Flaw

CVE-2025-54899 Overview

CVE-2025-54899 is a local code execution vulnerability in Microsoft Office Excel caused by freeing memory that was not allocated on the heap [CWE-590]. The flaw affects Microsoft 365 Apps, Excel 2016, Office 2019, and Office Long Term Servicing Channel (LTSC) 2021 and 2024 on both Windows and macOS. An attacker who convinces a user to open a crafted Excel document can execute arbitrary code in the context of the current user. Exploitation requires user interaction but no prior authentication or elevated privileges.

Critical Impact

Successful exploitation grants attackers code execution with the privileges of the targeted Excel user, enabling lateral movement, data theft, and persistence on the host.

Affected Products

• Microsoft 365 Apps (Enterprise, x86 and x64)
• Microsoft Excel 2016 and Microsoft Office 2019 (x86 and x64)
• Microsoft Office LTSC 2021 and 2024 (Windows x86/x64 and macOS)

Discovery Timeline

• 2025-09-09 - CVE-2025-54899 published to NVD
• 2025-09-09 - Microsoft releases security update via MSRC advisory
• 2025-09-12 - Last updated in NVD database

Technical Details for CVE-2025-54899

Vulnerability Analysis

The vulnerability stems from Excel calling a heap deallocation routine on a memory region that was not obtained from the heap allocator. This condition is classified under [CWE-590] (Free of Memory Not on the Heap). When the runtime attempts to release memory that originated from a stack frame, a static buffer, or another non-heap region, internal heap metadata structures become inconsistent. The resulting corruption can be steered by an attacker to overwrite function pointers, virtual table entries, or return addresses. The attack is local and requires the victim to open a malicious workbook, but no authentication is needed. Successful exploitation yields code execution in the Excel process context, with full impact to confidentiality, integrity, and availability of the user session.

Root Cause

The root cause is an object lifetime or allocator mismatch within Excel's document parsing or object handling code. A pointer referencing memory outside the heap is passed to free or an equivalent deallocator, corrupting allocator state. Microsoft has not published parser-level technical details.

Attack Vector

The attacker delivers a crafted .xls or .xlsx file through phishing, web download, or shared storage. Opening the document in a vulnerable Excel build triggers the erroneous free. Protected View provides some mitigation but is commonly bypassed when users enable editing on documents from trusted-looking senders.

No verified proof-of-concept code is publicly available for CVE-2025-54899. Refer to the Microsoft Security Update CVE-2025-54899 advisory for vendor guidance.

Detection Methods for CVE-2025-54899

Indicators of Compromise

• Excel (EXCEL.EXE) spawning unusual child processes such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
• Crash dumps or Windows Error Reporting events referencing heap corruption inside EXCEL.EXE.
• Inbound spreadsheets with embedded objects, malformed records, or unusually large or malformed BIFF/OOXML streams.
• Outbound network connections initiated by EXCEL.EXE to untrusted hosts shortly after document open.

Detection Strategies

• Hunt for Office applications launching script interpreters or LOLBins, a common post-exploitation behavior pattern.
• Inspect email gateways and web proxies for Excel attachments containing suspicious OLE objects or active content.
• Correlate Excel process crashes with subsequent file writes to user-writable autorun and startup locations.

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block child process creation from Office applications.
• Forward Sysmon process-creation and image-load events for EXCEL.EXE to a SIEM for behavioral baselining.
• Track document-open telemetry from Microsoft 365 audit logs to identify unusual file origins.

How to Mitigate CVE-2025-54899

Immediate Actions Required

• Apply the September 2025 Microsoft security updates to all affected Excel, Office, and Microsoft 365 Apps installations.
• Verify update deployment across Office LTSC 2021 and 2024 endpoints, including macOS clients which are explicitly affected.
• Block inbound Excel attachments from external senders at the email gateway until patching is complete.

Patch Information

Microsoft has released fixes documented in the Microsoft Security Update CVE-2025-54899 advisory. Use Microsoft Update, Click-to-Run, or your enterprise patch management workflow to deploy the corrected Excel binaries to every affected channel.

Workarounds

• Enforce Protected View and Office Application Guard for documents originating from the internet or email.
• Disable editing of Office files from untrusted locations using Trust Center policy and Group Policy Object (GPO) settings.
• Enable ASR rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to block Office applications from creating child processes.

# Enable ASR rule to block Office apps from creating child processes (PowerShell)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled