CVE-2025-59240: Microsoft 365 Apps Information Disclosure

CVE-2025-59240 Overview

CVE-2025-59240 is an information disclosure vulnerability in Microsoft Office Excel. The flaw allows an unauthorized attacker to disclose sensitive information locally when a user opens a specially crafted file. The issue is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Exploitation requires user interaction, typically opening a malicious Excel document. Successful exploitation exposes memory contents that may contain sensitive data belonging to the user or the Excel process. The vulnerability affects multiple supported Office releases, including Microsoft 365 Apps, Office 2019, and Office LTSC 2021 and 2024.

Critical Impact
Attackers can leverage a malicious Excel file to read sensitive data from the victim's Excel process, potentially exposing credentials, document contents, or in-memory secrets.

Affected Products

Microsoft 365 Apps (Enterprise, x64)
Microsoft Excel 2016 (x86 and x64)
Microsoft Office 2019 (x86 and x64)
Microsoft Office LTSC 2021 and 2024 (x86 and x64)

Discovery Timeline

2025-11-11 - CVE-2025-59240 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59240

Vulnerability Analysis

CVE-2025-59240 is an information disclosure flaw in the Microsoft Office Excel file parsing pipeline. Excel improperly handles memory when processing crafted spreadsheet content, allowing sensitive data to be exposed to an unauthorized actor. The vulnerability requires local access and user interaction, meaning the victim must open a malicious file delivered through email, a shared drive, or a web download.

The scope is limited to confidentiality; integrity and availability are not affected. Disclosed content may include uninitialized memory, portions of other documents open in the same Excel session, or process metadata useful for follow-on attacks. Attackers commonly chain information disclosure bugs with code execution vulnerabilities to bypass mitigations such as Address Space Layout Randomization (ASLR).

Root Cause

The root cause aligns with [CWE-200], where Excel discloses information that should remain private to the process. Microsoft's advisory does not disclose the specific parser component, but such flaws typically stem from reading beyond initialized buffers or serializing internal state into output structures during file processing.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious Excel workbook and delivers it to the target through phishing, file sharing, or a compromised website. When the user opens the file, Excel processes the malicious content and returns sensitive information to attacker-controlled fields within the document or exposes it through subsequent renderings.

No verified proof-of-concept exploit code is publicly available. Refer to the Microsoft CVE-2025-59240 Advisory for authoritative technical details.

Detection Methods for CVE-2025-59240

Indicators of Compromise

Unexpected Excel documents arriving via email attachments or external file shares that prompt users to enable content or macros.
Excel process (EXCEL.EXE) reading or writing to unusual file paths, temporary directories, or issuing outbound network connections after opening a document.
Office telemetry showing crashes or repeated abnormal terminations in EXCEL.EXE following user-opened files.

Detection Strategies

Correlate email gateway telemetry with endpoint file-open events to identify suspicious Excel workbooks originating from external senders.
Monitor for anomalous child processes spawned by EXCEL.EXE, including powershell.exe, cmd.exe, or rundll32.exe.
Deploy YARA rules targeting malformed Excel structures known to trigger memory disclosure conditions.

Monitoring Recommendations

Enable Microsoft Defender for Office 365 Safe Attachments and Safe Links to detonate inbound Excel files before delivery.
Ingest Office and endpoint logs into a centralized SIEM to hunt for post-open behaviors that may indicate exploitation attempts.
Track Office build versions across the fleet to confirm patch compliance and identify unpatched hosts opening untrusted files.

How to Mitigate CVE-2025-59240

Immediate Actions Required

Apply the Microsoft security updates for all affected Office versions as listed in the Microsoft CVE-2025-59240 Advisory.
Prioritize patching endpoints used by executives, finance, and human resources staff, who are frequent targets for Excel-based phishing.
Verify Microsoft 365 Apps update channels are enabled and installations are current.

Patch Information

Microsoft has released security updates that remediate CVE-2025-59240. Patches are distributed through Microsoft Update, the Microsoft Update Catalog, and the Microsoft 365 Apps update channel. Consult the Microsoft CVE-2025-59240 Advisory for the specific build numbers applicable to each affected product.

Workarounds

Enable Protected View for files originating from the internet and other untrusted locations to limit parser exposure.
Configure Office File Block policies to prevent legacy Excel formats from opening unless explicitly required by business workflows.
Restrict Office macro execution and enforce Attack Surface Reduction (ASR) rules that block Office applications from launching child processes.

bash

# Enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f