CVE-2025-48812
published 2025-07-08CVE-2025-48812: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
PriorityP425medium5.5CVSS 3.1
AVLACLPRNUIRSUCHINAN
EPSS
0.51%
40.4th percentile
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | excel | — | — |
| microsoft | microsoft_365_apps_for_enterprise | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_excel_2016 | >= 16.0.0.0 < 16.0.5508.1001 | 16.0.5508.1001 |
| microsoft | microsoft_office_2019 | >= 19.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2021 | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2024 | >= 16.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_for_mac_2021 | >= 16.0.1 < 16.99.25071321 | 16.99.25071321 |
| microsoft | microsoft_office_ltsc_for_mac_2024 | >= 16.0.0 < 16.99.25071321 | 16.99.25071321 |
| microsoft | office | — | — |
| microsoft | office_long_term_servicing_channel | — | — |
| microsoft | office_long_term_servicing_channel | — | — |
| microsoft | office_online_server | < 16.0.10417.20027 | 16.0.10417.20027 |
| microsoft | office_online_server | >= 16.0.0.0 < 16.0.10417.20027 | 16.0.10417.20027 |
| msrc | microsoft_365_apps_for_enterprise_for_32-bit_systems | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_64-bit_systems | — | — |
| msrc | microsoft_excel_2016 | — | — |
| msrc | microsoft_office_2019_for_32-bit_editions | — | — |
| msrc | microsoft_office_2019_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_32-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2024_for_32-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2024_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_for_mac_2021 | — | — |
| msrc | microsoft_office_ltsc_for_mac_2024 | — | — |
| msrc | office_online_server | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vendor_msrc5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v5j5-f44v-2p35: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally
ghsa_unreviewed·2025-07-08
CVE-2025-48812 [MEDIUM] CWE-125 GHSA-v5j5-f44v-2p35: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft
Microsoft Excel Information Disclosure Vulnerability
vendor_msrc·2025-07-08·CVSS 5.5
CVE-2025-48812 [MEDIUM] CWE-125 Microsoft Excel Information Disclosure Vulnerability
Microsoft Excel Information Disclosure Vulnerability
Description: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
FAQ: What type of information could be disclosed by this vulnerability?
An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.
FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
FAQ: Are the updates for Microsoft Office LTSC for Mac 2021 and 2024 currently available?
Yes. As of July 15, 2025, the security update for Microsoft Office LTSC for Mac 2021 and 2024 are available. Customers running Microsoft Office LTSC for
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-08
Published