CVE-2025-54902: Microsoft 365 Apps RCE Vulnerability

CVE-2025-54902 Overview

CVE-2025-54902 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel that enables local code execution. An unauthorized attacker can execute code by convincing a user to open a specially crafted spreadsheet. The flaw affects multiple Excel and Microsoft 365 Apps deployments across Windows and macOS. Microsoft published the advisory on September 9, 2025.

The vulnerability requires user interaction but does not require prior authentication. Successful exploitation results in high impact to confidentiality, integrity, and availability of the affected system.

Critical Impact
A local attacker can trigger arbitrary code execution in the context of the current user by delivering a malicious Excel document, enabling initial access, credential theft, or lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Excel 2016 (x86 and x64) and Microsoft Office 2019 (x86 and x64)
Microsoft Office Long Term Servicing Channel 2021 and 2024 (Windows and macOS), Microsoft Office Online Server

Discovery Timeline

2025-09-09 - CVE-2025-54902 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54902

Vulnerability Analysis

CVE-2025-54902 is an out-of-bounds read [CWE-125] in the file parsing logic of Microsoft Excel. When Excel processes a maliciously crafted spreadsheet, it reads memory outside the bounds of an allocated buffer. Attackers can use the leaked information to defeat memory protections such as Address Space Layout Randomization (ASLR) and then pivot to arbitrary code execution in the current user's context.

The vulnerability requires the victim to open a weaponized document, typically delivered through phishing, shared file services, or malicious download links. Because Office documents are a common initial access vector, this class of flaw is frequently combined with social engineering to bypass user suspicion. Successful exploitation yields code execution equivalent to the logged-in user, which is often sufficient for endpoint compromise on workstations where users hold local administrative rights.

Root Cause

The root cause is improper validation of length or offset fields within Excel's structured file formats. When a crafted record specifies an oversized or negative bound, the parser accesses memory beyond the intended buffer. The condition maps to CWE-125, Out-of-bounds Read, and can be chained with additional primitives to achieve local code execution.

Attack Vector

Exploitation is local and requires user interaction. The attacker delivers a specially crafted .xls, .xlsx, or .xlsb file to the target through email, chat, cloud storage, or web download. When the user opens the document, Excel parses the malicious structures and triggers the out-of-bounds read, which the attacker leverages to execute code within the Excel process.

No verified proof-of-concept code is currently published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing, and the EPSS probability is 0.54%.

Detection Methods for CVE-2025-54902

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel process crashes or Windows Error Reporting entries referencing memory access violations while opening a document.
Inbound Excel files from untrusted senders containing obfuscated binary records or unusually large record lengths.

Detection Strategies

Monitor Office applications for anomalous process creation chains and file writes to %TEMP%, %APPDATA%, or user startup directories.
Enable and forward Microsoft Defender Attack Surface Reduction (ASR) rule audit and block events, specifically the rule blocking Office applications from creating child processes.
Alert on outbound network connections initiated directly by EXCEL.EXE to unfamiliar destinations shortly after document open events.

Monitoring Recommendations

Ingest Windows Sysmon events 1, 3, 7, 11, and 15 from endpoints running Office, and correlate on Excel as the parent process.
Track patch compliance for Microsoft 365 Apps, Office 2016, Office 2019, and Office LTSC 2021/2024 across the fleet.
Retain Office document telemetry and email attachment metadata to support retroactive threat hunting when new indicators emerge.

How to Mitigate CVE-2025-54902

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2025-54902 advisory to every affected Office installation.
Prioritize patching for users who routinely open external spreadsheets, including finance, procurement, and executive assistants.
Verify that Microsoft 365 Apps update channels are not paused and confirm client build numbers after the update.

Patch Information

Microsoft released fixes through its September 2025 security update cycle. Consult the Microsoft Security Update CVE-2025-54902 page for the specific KB articles and build numbers that correspond to Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office Online Server.

Workarounds

Enable Protected View and Office Application Guard so that documents from the internet and email attachments open in an isolated container.
Configure Microsoft Defender ASR rules to block Office applications from creating child processes and from injecting into other processes.
Block or quarantine spreadsheet attachments from external senders at the mail gateway until the patch is deployed enterprise-wide.

bash

# Configuration example: enable key ASR rules via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A,`
  3B576869-A4EC-4529-8536-B80A7769E899,`
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled