SB2025051392 - Multiple vulnerabilities in Microsoft Excel

Main Vulnerability Database SB2025051392

SB2025051392 - Multiple vulnerabilities in Microsoft Excel

Published: May 13, 2025

Security Bulletin ID SB2025051392

Severity

High

Patch available

YES

Number of vulnerabilities 9

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 9 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2025-32704)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in Microsoft Excel. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system, leading to arbitrary code execution.

2) Heap-based buffer overflow (CVE-ID: CVE-2025-30376)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Microsoft Excel. A remote attacker can trick a victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

3) Type Confusion (CVE-ID: CVE-2025-30375)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in Microsoft Excel. A remote attacker can trick a victim to open a specially crafted file, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) Type Confusion (CVE-ID: CVE-2025-30383)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in Microsoft Excel. A remote attacker can pass specially crafted data to the application, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

5) Heap-based buffer overflow (CVE-ID: CVE-2025-29979)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Microsoft Excel. A remote attacker can trick a victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

6) Untrusted Pointer Dereference (CVE-ID: CVE-2025-30381)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference in Microsoft Excel. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the system.

7) Release of invalid pointer or reference (CVE-ID: CVE-2025-30379)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to release of invalid pointer or reference in Microsoft Excel. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

8) Use-after-free (CVE-ID: CVE-2025-30393)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Microsoft Excel. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

9) Use-after-free (CVE-ID: CVE-2025-29977)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Microsoft Excel. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Remediation

Install update from vendor's website.

References