CVE-2025-62561: Microsoft 365 Apps RCE Vulnerability

CVE-2025-62561 Overview

CVE-2025-62561 is an untrusted pointer dereference vulnerability in Microsoft Office Excel that allows local code execution. The flaw, classified under [CWE-822], occurs when Excel dereferences a pointer derived from attacker-controlled data inside a crafted spreadsheet. Successful exploitation runs arbitrary code in the context of the current user. Exploitation requires the victim to open a malicious file, satisfying the user interaction requirement.

Microsoft published the advisory on December 9, 2025. The vulnerability impacts multiple supported Office channels on Windows and macOS, including Microsoft 365 Apps, Office 2019, Office LTSC 2021, Office LTSC 2024, Excel 2016, and Office Online Server.

Critical Impact
A single crafted Excel document can deliver arbitrary code execution under the logged-on user's privileges, providing initial access for phishing-driven intrusion chains.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Excel 2016, Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024 (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2025-12-09 - CVE-2025-62561 published to NVD by Microsoft
2025-12-10 - Last updated in NVD database

Technical Details for CVE-2025-62561

Vulnerability Analysis

The vulnerability is an untrusted pointer dereference, tracked as [CWE-822]. Excel reads a pointer value from a crafted document and uses it without validating that it references memory the application owns or expects. When the parser dereferences this attacker-controlled pointer, control flow or data flow is redirected to memory the attacker influences.

Because Excel runs the malicious computation in-process, code executes with the privileges of the user opening the workbook. The attack is local in scope, but delivery typically occurs through phishing, file shares, or web downloads. Protected View and Mark-of-the-Web reduce risk only when the user does not click through to enable editing.

Root Cause

The root cause is missing validation of a pointer parsed from spreadsheet content before it is dereferenced. Pointer-bearing structures inside the binary or OOXML format are trusted as if they reference valid in-process objects. An attacker who controls the embedded value steers the dereference to chosen memory, enabling memory corruption or control transfer.

Attack Vector

The attacker delivers a crafted .xls, .xlsx, or related Excel file to the target. The victim opens the file in a vulnerable Excel version. Excel parses the document, dereferences the attacker-supplied pointer, and executes code in the user context. No network privilege is required, but user interaction is mandatory. See the Microsoft Security Update CVE-2025-62561 advisory for vendor technical guidance.

Detection Methods for CVE-2025-62561

Indicators of Compromise

Excel process (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe
Office documents arriving from external email with macros disabled but containing unusual embedded objects or OLE streams
Crash events for EXCEL.EXE with access violation exceptions in WER or Application logs immediately before suspicious activity
New persistence entries (Run keys, scheduled tasks) created in a user session that recently opened an Excel attachment

Detection Strategies

Hunt for parent-child process anomalies where EXCEL.EXE launches script interpreters, LOLBins, or network utilities
Monitor outbound network connections initiated by EXCEL.EXE to non-Microsoft destinations
Alert on Excel writing executable content (.exe, .dll, .js, .hta) to %TEMP%, %APPDATA%, or %PUBLIC%
Inspect inbound email attachments and SMB transfers for Excel files using sandbox detonation with crash telemetry

Monitoring Recommendations

Enable and forward Microsoft Defender, Sysmon (Event IDs 1, 7, 11), and Office telemetry to a central SIEM
Track patch deployment status for Office across all endpoints to identify unpatched hosts
Correlate Excel crashes with subsequent process or network activity within a short time window

How to Mitigate CVE-2025-62561

Immediate Actions Required

Apply the December 2025 Microsoft security updates for all affected Office channels using the guidance in the Microsoft Security Update CVE-2025-62561 advisory
Inventory endpoints running Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021 and 2024, and Office Online Server, and prioritize patching
Block or quarantine inbound Excel attachments from untrusted senders at the email gateway until patches are fully deployed
Enforce Protected View and Mark-of-the-Web for files originating from the internet and email

Patch Information

Microsoft released fixes through the December 9, 2025 security update cycle. Patches are distributed via Microsoft Update, the Microsoft Update Catalog, and Click-to-Run for Microsoft 365 Apps. Office Online Server administrators must apply the server-side update. Refer to the Microsoft Security Update CVE-2025-62561 page for build numbers and channel-specific KB articles.

Workarounds

Open untrusted spreadsheets only in Protected View and avoid clicking Enable Editing on files from unknown sources
Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from creating executable content
Restrict execution of .xls/.xlsx files originating from internet zones via Group Policy until patching is verified

bash

# Example: enforce ASR rules that block Office child processes and executable creation
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A, `
  3B576869-A4EC-4529-8536-B80A7769E899 `
  -AttackSurfaceReductionRules_Actions Enabled, Enabled