CVE-2025-54903: Microsoft 365 Apps Use-After-Free Flaw

CVE-2025-54903 Overview

CVE-2025-54903 is a use-after-free vulnerability [CWE-416] in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw affects multiple Office product lines, including Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office Online Server. Exploitation requires user interaction, typically by opening a crafted Excel file. Successful exploitation gives the attacker code execution in the context of the current user, leading to full compromise of confidentiality, integrity, and availability on the local host.

Critical Impact
An attacker who convinces a user to open a malicious Excel document can execute arbitrary code with the user's privileges across all supported Office channels.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024 (including macOS builds)
Microsoft Office Online Server

Discovery Timeline

2025-09-09 - CVE-2025-54903 published to NVD
2025-09-12 - Last updated in NVD database

Technical Details for CVE-2025-54903

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] inside Microsoft Excel's document parsing or object handling logic. Excel frees a heap-allocated object but retains a dangling reference that is later dereferenced when the document is processed. An attacker controls the contents of the reallocated memory by shaping the heap with crafted spreadsheet structures. Dereferencing the freed object then redirects execution flow into attacker-controlled data, enabling arbitrary code execution within the Excel process.

The attack vector is local and requires user interaction, meaning the victim must open a malicious .xls, .xlsx, or related spreadsheet file. Because Office files are routinely shared through email, collaboration platforms, and web downloads, the practical exposure is broad. The EPSS score is 0.132%, but use-after-free bugs in Office have a history of weaponization through phishing campaigns.

Root Cause

The root cause is improper lifetime management of an in-memory object during Excel document processing. After the object is released, a stale pointer continues to be used, violating safe memory access invariants and producing exploitable type confusion or control-flow hijack primitives.

Attack Vector

An attacker crafts a malicious Excel document and delivers it via phishing email, a shared cloud drive, or a web download. When the user opens the file, Excel triggers the vulnerable allocation and free sequence. Heap grooming inside the document causes attacker-controlled bytes to occupy the freed slot. Code executes with the privileges of the user running Excel, which on workstations is typically a standard interactive user. The technical details for exploitation are not publicly documented; refer to the Microsoft CVE-2025-54903 Advisory for vendor guidance.

Detection Methods for CVE-2025-54903

Indicators of Compromise

Excel (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe
Excel process crashes or anomalous exception events shortly after opening a document from an untrusted source
Spreadsheets received from external senders containing unusual embedded objects, OLE streams, or oversized binary records
Outbound network connections initiated by EXCEL.EXE to uncategorized or newly registered domains

Detection Strategies

Hunt for parent-child process chains where Office applications spawn script interpreters or living-off-the-land binaries (LOLBins)
Monitor Windows Error Reporting and application crash telemetry for repeated faults in EXCEL.EXE modules
Inspect attachments at the mail gateway for malformed Excel files using static analysis and sandbox detonation

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes
Forward Sysmon Event ID 1 (process create) and Event ID 11 (file create) from EXCEL.EXE to a central SIEM
Track Office telemetry for use of unusual file formats and macros originating from internet-zone documents

How to Mitigate CVE-2025-54903

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2025-54903 Advisory to all affected Excel and Office installations
Verify update deployment across Microsoft 365 Apps, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office Online Server
Restrict opening of Excel documents from untrusted sources and enforce Protected View for files originating from the internet

Patch Information

Microsoft has released a security update addressing CVE-2025-54903. Patch availability and version-specific build numbers are documented in the Microsoft CVE-2025-54903 Advisory. Administrators should validate patch installation through Windows Update, Microsoft 365 Apps update channels, or WSUS depending on the deployment model.

Workarounds

Enforce Protected View and Office Application Guard for documents from the internet and email attachments
Use Group Policy to disable legacy Excel file formats (such as .xls) where compatibility allows
Deploy ASR rules to block Office child process creation and to block Win32 API calls from Office macros

bash

# Configuration example: enable ASR rule to block Office from spawning child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled