CVE-2025-59235: Microsoft 365 Apps Info Disclosure Flaw

CVE-2025-59235 Overview

CVE-2025-59235 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel that enables local information disclosure. An unauthorized attacker can read memory beyond intended buffer boundaries when a victim opens a maliciously crafted Excel file. The flaw affects multiple Microsoft products that share Excel parsing components, including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, Office Online Server, and SharePoint Server 2016/2019. Exploitation requires user interaction, typically opening or previewing a weaponized spreadsheet. Microsoft published the advisory on October 14, 2025.

Critical Impact
Successful exploitation can disclose sensitive process memory contents and contribute to availability impact on the affected application, potentially leaking data that aids follow-on attacks.

Affected Products

Microsoft 365 Apps (Enterprise, x64/x86)
Microsoft Excel 2016, Microsoft Office 2019, Office LTSC 2021 and 2024 (including macOS)
Microsoft Office Online Server, SharePoint Server 2016 Enterprise, SharePoint Server 2019

Discovery Timeline

2025-10-14 - CVE-2025-59235 published to NVD
2025-10-16 - Last updated in NVD database

Technical Details for CVE-2025-59235

Vulnerability Analysis

The vulnerability stems from improper bounds checking when Excel parses structured content within a workbook file. When the parser encounters a malformed record, length field, or offset, it reads past the end of an allocated buffer. This out-of-bounds read [CWE-125] exposes adjacent memory contents to the parsing logic, which an attacker can exfiltrate or use to bypass mitigations such as Address Space Layout Randomization (ASLR).

The issue is local in scope. An attacker must deliver a crafted Excel document and convince a user to open it. Common delivery channels include phishing email attachments, malicious downloads, and documents hosted on trusted file-sharing platforms. Preview pane handlers and server-side rendering paths in Office Online Server and SharePoint expand the exposure surface where the file may be parsed without an explicit user open action.

Root Cause

The root cause is missing or incorrect validation of record size and offset values inside Excel's binary file parsing routines. The parser trusts attacker-controlled length fields and dereferences memory beyond the bounds of the source buffer, returning sensitive heap or stack contents to the rendering layer.

Attack Vector

The attack is local and requires user interaction. The attacker crafts a malicious .xls, .xlsx, or related Office document with manipulated internal structures. When the victim opens the file in a vulnerable Excel build or when a server-side component renders the document, the out-of-bounds read triggers. The disclosed memory may contain credentials, document fragments, tokens, or pointers useful for chaining with code execution flaws.

No verified public proof-of-concept code or exploit is available for CVE-2025-59235 at this time. Refer to the Microsoft Security Update CVE-2025-59235 for vendor-provided technical context.

Detection Methods for CVE-2025-59235

Indicators of Compromise

Excel or Office processes (EXCEL.EXE, wacserver.exe) crashing or generating Windows Error Reporting events after opening a document from an external source
Inbound email attachments or downloads containing Excel files with malformed BIFF/OOXML records flagged by content inspection
Unexpected child processes or network connections initiated by Office applications immediately after a document is opened

Detection Strategies

Inspect Office document parsing telemetry for anomalous record sizes, oversized offsets, or malformed compound file structures
Monitor for Office applications reading memory regions or crashing in modules associated with spreadsheet parsing
Correlate user-opened document events with subsequent suspicious behavior such as credential access or staging activity

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that restrict Office child-process creation and macro execution
Forward Office telemetry, Windows Error Reporting, and email gateway logs to a centralized SIEM for correlation
Track SharePoint and Office Online Server logs for repeated document render failures, which may indicate exploitation attempts

How to Mitigate CVE-2025-59235

Immediate Actions Required

Apply Microsoft's October 2025 security updates for all affected Office, Microsoft 365 Apps, Office Online Server, and SharePoint Server versions
Inventory endpoints and servers running affected builds and prioritize patching for systems exposed to untrusted documents
Block or quarantine Excel attachments from untrusted senders at the email gateway until patches are deployed

Patch Information

Microsoft has released security updates addressing CVE-2025-59235. Administrators should consult the Microsoft Security Update CVE-2025-59235 advisory for the specific KB articles and build numbers applicable to each affected product line, including Microsoft 365 Apps Click-to-Run channels, Office 2019, Office LTSC 2021/2024, Office Online Server, and SharePoint Server 2016/2019.

Workarounds

Open untrusted Excel documents in Protected View and disable the Outlook and File Explorer preview handlers for Office formats
Restrict Excel file types at the mail gateway and apply ASR rules blocking Office applications from spawning child processes
Use Application Guard for Office to isolate untrusted documents in a hardware-based container until patches can be applied

bash

# Example: disable Excel preview handler via registry on Windows endpoints
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\PreviewHandlers" /v "{00020827-0000-0000-C000-000000000046}" /t REG_SZ /d "" /f

# Example: enable ASR rule blocking Office child processes (PowerShell)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled