CVE-2025-62556: Microsoft 365 Apps RCE Vulnerability

CVE-2025-62556 Overview

CVE-2025-62556 is an untrusted pointer dereference vulnerability [CWE-822] in Microsoft Office Excel. The flaw enables an unauthorized attacker to execute arbitrary code locally on a target system after a user opens a crafted Excel document. The vulnerability affects multiple Microsoft Office product families, including Microsoft 365 Apps, Excel 2016, Office 2019, the Office Long Term Servicing Channel (LTSC) 2021 and 2024 editions, and Office Online Server. Exploitation requires user interaction, and the attack vector is local. Microsoft has published a security advisory addressing the issue.

Critical Impact

Successful exploitation grants attackers code execution under the privileges of the user opening a malicious Excel file, leading to full confidentiality, integrity, and availability compromise on the host.

Affected Products

• Microsoft 365 Apps (Enterprise, x86 and x64)
• Microsoft Excel 2016, Microsoft Office 2019, and Office LTSC 2021 / 2024 (Windows and macOS)
• Microsoft Office Online Server

Discovery Timeline

• 2025-12-09 - CVE-2025-62556 published to the National Vulnerability Database (NVD)
• 2025-12-10 - Last updated in NVD database

Technical Details for CVE-2025-62556

Vulnerability Analysis

The vulnerability is classified as an untrusted pointer dereference [CWE-822] inside Microsoft Office Excel. Excel reads a pointer value from attacker-controlled data in a malicious workbook and dereferences it without validating that the pointer references memory the application owns or trusts. When Excel parses the crafted document, the corrupted pointer is used in a read or write operation, leading to memory corruption and control-flow hijack. Because Excel processes complex file formats with embedded objects, formulas, and binary records, the attack surface for malformed pointer values is broad. Exploitation results in arbitrary code execution within the security context of the user who opened the file.

Root Cause

The root cause is the use of a pointer value sourced from untrusted document content without validation against expected object boundaries or type information. Office file formats such as XLSB and legacy XLS use offset and reference structures that, if not strictly bounds-checked, can be coerced into pointing at attacker-chosen memory.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a weaponized Excel document via email, web download, or shared storage. When the victim opens the file (and bypasses Protected View or Mark-of-the-Web warnings), Excel parses the malicious record and dereferences the untrusted pointer. The resulting memory corruption is leveraged to execute attacker-supplied shellcode or to pivot into living-off-the-land tooling. No authentication to the host is required from the attacker, but the victim must execute the document.

No public proof-of-concept code has been verified at the time of writing. Refer to the Microsoft CVE-2025-62556 Advisory for vendor technical details.

Detection Methods for CVE-2025-62556

Indicators of Compromise

• Excel (EXCEL.EXE) spawning unusual child processes such as cmd.exe, powershell.exe, rundll32.exe, mshta.exe, or wscript.exe.
• Crashes or anomalous exception events in EXCEL.EXE shortly after opening attachments, especially with access violation codes consistent with bad pointer dereferences.
• Excel processes initiating outbound network connections to untrusted hosts immediately after document open.
• Creation of executables, scripts, or scheduled tasks in user-writable paths (%APPDATA%, %TEMP%) by an Office process.

Detection Strategies

• Hunt for parent-child process chains where EXCEL.EXE is the parent of script interpreters or LOLBins.
• Inspect mail and web gateway telemetry for Excel attachments (.xls, .xlsx, .xlsb, .xlsm) originating from low-reputation senders.
• Use YARA or static analysis to flag Office documents containing malformed BIFF records, suspicious embedded objects, or obfuscated formulas.
• Correlate Windows Error Reporting (WER) crash data for Excel with subsequent suspicious process activity on the same host.

Monitoring Recommendations

• Enable and centralize Microsoft Defender ASR rule telemetry, especially "Block all Office applications from creating child processes."
• Forward Sysmon process creation, image load, and network connection events for Office binaries to a SIEM or data lake.
• Track Office version and patch status across endpoints to identify hosts still exposed to CVE-2025-62556.

How to Mitigate CVE-2025-62556

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft CVE-2025-62556 Advisory to all affected Office installations.
• Inventory endpoints for vulnerable builds of Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021/2024, and Office Online Server, and prioritize patching.
• Enforce Protected View and Mark-of-the-Web for files received from email and the internet.
• Restrict execution of Office macros and block child process creation from Office applications via Attack Surface Reduction rules.

Patch Information

Microsoft has published patches for all affected Office products. Customers should consult the Microsoft CVE-2025-62556 Advisory for the specific build numbers and Click-to-Run channel updates that remediate this vulnerability. Microsoft 365 Apps users on supported update channels will receive the fix automatically; volume-licensed Office 2019 and LTSC editions require manual deployment of the corresponding security update.

Workarounds

• Open untrusted Excel documents only in Protected View or Office for the web until patches are deployed.
• Use Group Policy to disable opening of legacy and binary Excel file formats (.xls, .xlsb) from internet zones where feasible.
• Apply Attack Surface Reduction (ASR) rules to block Office processes from creating executable content and spawning child processes.
• Restrict end-user privileges so that any code executed by a compromised Excel session runs without administrative rights.

# Enable Microsoft Defender ASR rules to limit Office exploitation impact
# Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Block Office applications from creating executable content
Add-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 `
                 -AttackSurfaceReductionRules_Actions Enabled

# Block Win32 API calls from Office macros
Add-MpPreference -AttackSurfaceReductionRules_Ids 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B `
                 -AttackSurfaceReductionRules_Actions Enabled