CVE-2025-60728 Overview
CVE-2025-60728 is an information disclosure vulnerability in Microsoft Office Excel caused by an untrusted pointer dereference. The flaw allows an unauthorized attacker to disclose limited information over a network when a user opens a specially crafted Excel file. The vulnerability is classified under CWE-125 (Out-of-Bounds Read) and requires user interaction to trigger. Microsoft assigned this CVE a medium severity rating with a CVSS 3.1 base score of 4.3.
Critical Impact
Successful exploitation allows attackers to read memory contents from Excel processes, potentially exposing sensitive data through crafted spreadsheet files delivered via phishing or file-sharing channels.
Affected Products
- Microsoft 365 Apps (Enterprise, x64 and x86)
- Microsoft Office Long Term Servicing Channel 2024 (x64 and x86)
- Microsoft Office Long Term Servicing Channel 2024 for macOS
Discovery Timeline
- 2025-11-11 - CVE-2025-60728 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60728
Vulnerability Analysis
The vulnerability resides in the memory handling routines of Microsoft Office Excel. Excel dereferences a pointer that has not been validated against expected boundaries. This produces an out-of-bounds read condition that leaks memory content adjacent to the intended structure. Attackers exploit this behavior by crafting a malicious Excel document containing malformed structures that trigger the untrusted dereference on parse.
The exploitation path requires the victim to open the crafted file. Because Excel documents remain a common attachment type, adversaries frequently pair such flaws with phishing campaigns. The disclosed information may include memory contents that assist in further attacks, such as bypassing address space layout randomization or extracting fragments of sensitive data held in process memory.
The issue does not directly allow code execution or modification of data. However, memory disclosure vulnerabilities often serve as building blocks in exploit chains targeting Office applications.
Root Cause
The root cause is improper validation of a pointer prior to dereferencing it during Excel document parsing. When Excel processes a malformed file, the parsing logic follows an attacker-controlled pointer without verifying that the referenced memory falls within expected bounds. This corresponds to [CWE-125] Out-of-Bounds Read behavior.
Attack Vector
The attack vector is network-based with required user interaction. An attacker crafts a malicious .xlsx or .xls file and delivers it through email, cloud storage links, or web downloads. When the victim opens the file in a vulnerable Excel version, the parser triggers the untrusted pointer dereference and returns leaked memory contents to attacker-controlled document elements or channels.
Exploitation details for CVE-2025-60728 are described in the Microsoft Security Update Guide. No public proof-of-concept exploit code has been observed at the time of publication.
Detection Methods for CVE-2025-60728
Indicators of Compromise
- Excel files received from untrusted sources containing malformed OLE, XML, or binary record structures inconsistent with normal spreadsheet layouts.
- Unexpected Excel process crashes or anomalous memory access patterns during document open operations.
- Outbound network connections initiated by EXCEL.EXE shortly after opening an attachment.
Detection Strategies
- Inspect email attachments and file shares for Excel documents containing malformed records that could trigger parser anomalies.
- Correlate Excel process telemetry with suspicious child process creation or network connections following document open events.
- Deploy YARA rules targeting known malicious Office document patterns and structures leveraged by information disclosure exploits.
Monitoring Recommendations
- Monitor endpoints for Office application versions and ensure updates from the November 2025 Microsoft security release are applied.
- Log and review Excel telemetry, including document open events, macro execution, and external content retrieval.
- Track outbound HTTP/HTTPS traffic from Office processes to identify potential data exfiltration attempts.
How to Mitigate CVE-2025-60728
Immediate Actions Required
- Apply the Microsoft security updates referenced in the Microsoft Security Update Guide for all affected Microsoft 365 Apps and Office LTSC 2024 installations.
- Restrict opening of Excel files from untrusted sources and enforce Protected View for documents originating from the internet.
- Educate users about the risks of opening unsolicited Excel attachments delivered via email or messaging platforms.
Patch Information
Microsoft released fixes for CVE-2025-60728 as part of its security update cycle. Administrators should deploy the updates listed in the Microsoft Security Update Guide across all affected Microsoft 365 Apps and Office LTSC 2024 endpoints, including macOS installations.
Workarounds
- Enable Protected View and Application Guard for Office to isolate untrusted documents from the host system.
- Block Excel file types at the email gateway when they originate from external senders and do not match business requirements.
- Configure Attack Surface Reduction rules in Microsoft Defender to block Office applications from launching child processes and creating executable content.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
