CVE-2025-54901: Microsoft 365 Apps Information Disclosure

CVE-2025-54901 Overview

CVE-2025-54901 is a buffer over-read vulnerability in Microsoft Office Excel that enables local information disclosure. An attacker can craft a malicious spreadsheet that, when opened by a user, causes Excel to read memory beyond an intended buffer boundary. The out-of-bounds data can include process memory that should remain private to the application. Microsoft published the advisory on September 9, 2025, and the flaw affects Microsoft 365 Apps, Excel 2016, Office 2019, and Office Long Term Servicing Channel 2021 and 2024, including the macOS builds of the LTSC releases. The weakness is classified under [CWE-126: Buffer Over-read].

Critical Impact
A crafted Excel document can leak sensitive memory contents from the Excel process to an attacker who convinces a user to open it, potentially exposing credentials, tokens, or other in-memory data used to enable follow-on attacks.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Excel 2016 and Microsoft Office 2019 (x86 and x64)
Microsoft Office Long Term Servicing Channel 2021 and 2024 (Windows and macOS)

Discovery Timeline

2025-09-09 - CVE-2025-54901 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54901

Vulnerability Analysis

The issue is a buffer over-read triggered during Excel's parsing of a specially crafted spreadsheet. When Excel processes malformed record structures, it reads past the end of an allocated buffer and returns adjacent process memory to the caller. The disclosed bytes can be exfiltrated through document fields, chart data, or other structures rendered from the parsed input. Exploitation requires the user to open the file locally, so social engineering through email attachments or file-sharing services is the most likely delivery method. Successful exploitation results in confidentiality loss only; the vulnerability does not modify data or crash the host. Attackers commonly chain information-disclosure primitives with memory corruption bugs to bypass Address Space Layout Randomization (ASLR) and achieve reliable code execution.

Root Cause

The root cause is missing or incorrect length validation on a field within an Excel binary structure. Excel trusts an attacker-controlled size or offset value and reads beyond the intended buffer boundary, a defect tracked under [CWE-126]. Microsoft has not published low-level details on the specific record type or parser function involved.

Attack Vector

Exploitation requires local user interaction: the target must open a malicious .xls, .xlsx, .xlsm, or related Excel file. The attacker does not need prior authentication on the victim system, and the file can be delivered by email, download, or removable media. See the Microsoft CVE-2025-54901 Advisory for vendor-supplied guidance. No public proof-of-concept exploit is available at the time of writing.

Detection Methods for CVE-2025-54901

Indicators of Compromise

Excel documents received from untrusted senders that contain unusual embedded objects, malformed records, or abnormally large binary streams.
Unexpected crashes or Windows Error Reporting entries generated by EXCEL.EXE shortly after opening a specific attachment.
Outbound network connections initiated by EXCEL.EXE immediately following the opening of a spreadsheet, which may indicate exfiltration of leaked memory.

Detection Strategies

Inspect email gateways and file-sharing platforms for Excel attachments that fail structural validation or contain oversized records.
Correlate EXCEL.EXE process telemetry with subsequent access to credential stores, browser data, or LSASS memory to identify chained post-exploitation activity.
Use YARA rules focused on malformed BIFF or OOXML structures to flag suspicious spreadsheets at ingress.

Monitoring Recommendations

Monitor endpoints for Office child-process creation patterns such as EXCEL.EXE spawning cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Alert on Office applications making outbound HTTP or DNS requests to newly observed domains after a document open event.
Track Windows Error Reporting and application crash events tied to Excel versions listed in the advisory as a possible exploitation signal.

How to Mitigate CVE-2025-54901

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2025-54901 Advisory to all affected Office and Microsoft 365 Apps installations.
Verify update deployment on macOS builds of Office LTSC 2021 and 2024, which are explicitly listed as affected.
Enforce Protected View and Office Application Guard for documents originating from the internet or email attachments.

Patch Information

Microsoft has issued fixes through its standard update channels. Administrators should confirm current build numbers for Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021 and 2024 against Microsoft's release notes and deploy the September 2025 security update or later servicing releases.

Workarounds

Block or quarantine Excel file types at the email gateway when sent from untrusted external senders.
Configure Group Policy to open files from the internet in Protected View and disable editing until user confirmation.
Restrict use of vulnerable Excel versions on high-value hosts, such as those handling credentials or administrative workflows, until patches are verified.

bash

# Configuration example: enforce Protected View via registry on Windows endpoints
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f