Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally

CVE-2025-32704 is a critical buffer over-read vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute arbitrary code locally on the affected system. The flaw arises from improper memory handling in Excel, where the program reads beyond the intended buffer boundaries when processing specially crafted Excel files. This can lead to execution of attacker-controlled code within the context of the logged-in user.

Affected Products and Versions:

• Microsoft Office Excel 2016 (all editions)
• Microsoft 365 Apps for Enterprise (x86 and x64)
• Excel for macOS (versions 16.75 and earlier)
• Microsoft Office 2019 (x86 and x64)
• Office Long Term Servicing Channel versions 2021 and 2024 (x86 and x64)
• Office 2024
• These versions are vulnerable regardless of specific configuration, provided the attacker has local access to the system.

Technical Details:
The vulnerability is classified as a buffer over-read (CWE-126), where Excel fails to validate memory buffer boundaries properly. Attackers exploit this by crafting malicious Excel files that, when opened or previewed by a user, trigger the vulnerability and allow code execution without requiring further user interaction. This minimal interaction requirement increases the risk of stealthy exploitation. The attack vector is local, but the payload can be delivered remotely via phishing emails, malicious downloads, or cloud storage links.

Severity and Impact:

• CVSS v3.1 Base Score: 8.4 (High severity)
• Attack Vector: Local (AV:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Impact: Complete confidentiality, integrity, and availability compromise (C:H/I:H/A:H)
• Exploitability Score: Moderate
• Impact Score: High

A successful exploit can lead to system compromise, arbitrary code execution, and potential data leakage.

Mitigation and Patch Information:
Microsoft addressed this vulnerability in the May 2025 security update (KB5002695). It is strongly recommended that users and administrators apply this patch immediately via Windows Update or enterprise management tools. Additional mitigations include:

• Restricting local user privileges
• Implementing application whitelisting policies
• Enhancing endpoint monitoring to detect unusual Excel activity
• User education to avoid opening suspicious Excel files
• Restricting macros and active content, although this vulnerability itself is not macro-based, attackers may use macros post-exploitation.

Summary:
CVE-2025-32704 represents a significant security risk due to its ability to allow local code execution through a buffer over-read in Excel. The vulnerability affects multiple Microsoft Office versions and platforms. Prompt patching and layered security measures are essential to prevent exploitation and potential system compromise.