CVE-2025-60726: Microsoft 365 Apps Info Disclosure Flaw

CVE-2025-60726 Overview

CVE-2025-60726 is an out-of-bounds read vulnerability in Microsoft Office Excel that enables local information disclosure. The flaw, classified under [CWE-125], affects Microsoft 365 Apps, Excel 2016, Office 2019, Office Long Term Servicing Channel (LTSC) 2021 and 2024, and Office Online Server. An unauthorized attacker can craft a malicious Excel file that, when opened by a victim, reads memory beyond allocated buffer boundaries. Successful exploitation discloses sensitive process memory contents to the attacker. Microsoft published the advisory on November 11, 2025, and updated it on November 17, 2025. The vulnerability requires user interaction and a local attack vector.

Critical Impact
Attackers can disclose sensitive in-process memory from Microsoft Excel by enticing a user to open a crafted spreadsheet, potentially exposing data that aids further compromise.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021 and 2024 (including macOS)
Microsoft Office Online Server

Discovery Timeline

2025-11-11 - CVE-2025-60726 published to the National Vulnerability Database (NVD)
2025-11-11 - Microsoft releases security update guidance for CVE-2025-60726
2025-11-17 - Last updated in NVD database

Technical Details for CVE-2025-60726

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in Microsoft Office Excel's file parsing logic. When Excel processes a malformed spreadsheet, it reads memory beyond the bounds of an allocated buffer. The read operation returns adjacent process memory that may contain sensitive data such as heap metadata, pointers, or document content from other parsing contexts. The exploitation requires the victim to open the malicious document, satisfying the user interaction requirement. The confidentiality impact is high while integrity remains unaffected, consistent with a read-only memory disclosure primitive.

Root Cause

The root cause stems from insufficient validation of length or offset fields within a structured Excel file format. Excel trusts attacker-controlled size or index values when copying or reading from internal data structures, allowing reads past the end of allocated memory. Microsoft's advisory does not enumerate the specific file format component, but [CWE-125] indicates the parser lacks proper boundary checks before dereferencing memory.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted .xlsx, .xls, or related Excel file through email, web download, or file share. When the victim opens the file in a vulnerable Excel build, the parser reads out-of-bounds memory. The disclosed data may be exfiltrated through file content rendered to the document, telemetry channels, or chained with secondary flaws to defeat memory protections such as Address Space Layout Randomization (ASLR). Refer to the Microsoft Security Update Guide for CVE-2025-60726 for vendor technical details.

Detection Methods for CVE-2025-60726

Indicators of Compromise

Unexpected Excel process crashes or Windows Error Reporting (WER) events referencing EXCEL.EXE shortly after opening externally sourced documents.
Excel documents originating from untrusted email senders or recently downloaded from the internet that contain unusually malformed binary or OOXML structures.
Excel spawning unexpected child processes or making outbound network connections after opening a spreadsheet attachment.

Detection Strategies

Inspect inbound email attachments and shared spreadsheets with sandbox detonation to surface malformed Excel files that trigger parser anomalies.
Correlate EXCEL.EXE exception telemetry with Mark-of-the-Web attributes to identify documents arriving from external sources that crash the parser.
Hunt for process memory access patterns where Excel reads or transmits large or unusual data buffers immediately after document open events.

Monitoring Recommendations

Forward Microsoft Office telemetry, Windows Event Logs, and EDR process events to a centralized SIEM for retrospective analysis.
Track Excel version inventory across endpoints to confirm patch coverage for Microsoft 365 Apps, Office 2019, Office LTSC 2021 and 2024, and Office Online Server.
Alert on Excel processes loading uncommon add-ins or accessing sensitive document repositories after opening recently received attachments.

How to Mitigate CVE-2025-60726

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-60726 to all affected Excel and Office installations.
Enforce Protected View and Mark-of-the-Web for documents originating from the internet, email, or untrusted file shares.
Block or quarantine Excel attachments from external senders at the email gateway until patches are deployed.

Patch Information

Microsoft has released security updates addressing CVE-2025-60726 across Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office Online Server. Administrators should consult the Microsoft Security Update Guide for the specific Knowledge Base (KB) article and build numbers applicable to each channel. Microsoft 365 Apps update automatically through the Click-to-Run channel, while volume-licensed Office editions require deployment through Microsoft Update, WSUS, or Microsoft Configuration Manager.

Workarounds

Disable preview handlers for Excel files in Windows Explorer and Outlook to prevent automatic parsing of untrusted spreadsheets.
Configure Office Trust Center policies to block macros and external content in files from the internet zone.
Restrict Excel file handling on high-value endpoints to least-privilege user accounts to limit the value of any disclosed memory.

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f