CVE-2025-60727: Microsoft 365 Apps Excel Out-of-Bounds Read Enables Remote Code Execution

CVE-2025-60727 (TL-2026-1205) is a high-severity software vulnerability scored CVSS 7.8, first published 2026-07-11. It has no confirmed attribution, affects Microsoft Microsoft 365 Apps, references 1 CVE (CVE-2025-60727), maps to 23 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-1205

Threat ID
TL-2026-1205
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-11
Last reviewed
2026-07-11
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, manufacturing, technology, education, legal, retail
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
16

An out-of-bounds read vulnerability (CWE-125) in how Microsoft Excel parses crafted spreadsheet files allows an attacker to execute arbitrary code in the context of the current user when a victim opens a malicious Excel document. No authentication or elevated privileges are required, but user interaction is mandatory; the primary delivery vector is phishing with weaponized Excel attachments.

How CVE-2025-60727 works

CVE-2025-60727 is a locally-exploitable memory-safety vulnerability (CWE-125, out-of-bounds read) in Microsoft Excel's file-parsing engine, affecting Microsoft 365 Apps (Enterprise, x86/x64), Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office Online Server on Windows and macOS. The root cause is insufficient validation of length and offset values while Excel parses internal binary/OOXML spreadsheet structures (.xls/.xlsx). When Excel processes a specially crafted file, it reads memory beyond the bounds of an allocated buffer; an attacker who controls the malformed structure can leverage this out-of-bounds read to influence subsequent execution flow and ultimately achieve arbitrary code execution running with the current user's privileges (CIA impact: High/High/High).

Exploitation requires no authentication and no elevated privileges (PR:N), but does require user interaction (UI:R) — the victim must open the malicious file — which places this squarely in the phishing-delivered document category rather than a zero-click threat. Microsoft's CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 7.8) reflects a Local attack vector because exploitation occurs through local file parsing once the file is opened on the victim's machine, with Low attack complexity and no special conditions beyond the malformed file itself.

The likely attack chain: an adversary crafts a malicious .xls/.xlsx file with malformed internal structures (e.g., anomalous OLE objects, corrupted record length/offset fields), delivers it via a phishing email disguised as an invoice, business report, or shared document, or via file-sharing/drive-by download vectors, and waits for the victim to open it in Excel (desktop client, Microsoft 365 Apps, or Office Online Server rendering). Upon opening, the parsing logic reads past the allocated buffer, corrupting adjacent memory or leaking pointer/heap layout information that the attacker's crafted payload uses to redirect execution and run arbitrary code in the security context of the logged-on user — enabling follow-on activity such as dropper execution, persistence establishment, credential access, and lateral movement.

As of the source article date (2026-06-29) there is no public proof-of-concept exploit code and no confirmed in-the-wild/active exploitation; the CVE is not present in the CISA Known Exploited Vulnerabilities (KEV) catalog (checked against the 2026-07-10 KEV release, 1,637 entries). EPSS scoring is low (~0.05-0.49% depending on source/date), consistent with a vulnerability that is patched but not yet weaponized publicly. The vulnerability was first published by NVD/MSRC on 2025-11-11 and last updated 2026-06-17. Given the broad Microsoft 365/Office product footprint, the phishing-friendly delivery model, and historical precedent of Office memory-corruption bugs being weaponized after patch analysis (n-day exploitation via patch diffing), this threat remains a high-signal tracking candidate for detection engineering and patch-compliance monitoring despite the absence of confirmed active exploitation.

MITRE ATT&CK techniques used in TL-2026-1205

Credential Access

T1003 OS Credential Dumping

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services

Defense Evasion

T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Persistence

T1137 Office Application Startup; T1547 Boot or Logon Autostart Execution

Impact

T1565 Data Manipulation

Initial Access

T1566 Phishing

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1598 Phishing for Information

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CVE-2025-60727

  • Microsoft — Microsoft 365 Apps
    Vulnerable versions: Enterprise x86; Enterprise x64
    Fixed in: Apply latest Click-to-Run security update
  • Microsoft — Excel 2016
    Vulnerable versions: 2016 (unpatched builds)
    Fixed in: Latest Office 2016 security update
  • Microsoft — Office 2019
    Vulnerable versions: 2019 (unpatched builds)
    Fixed in: Latest Office 2019 security update
  • Microsoft — Office LTSC 2021
    Vulnerable versions: LTSC 2021 (unpatched builds)
    Fixed in: Latest Office LTSC 2021 security update
  • Microsoft — Office LTSC 2024
    Vulnerable versions: LTSC 2024 (unpatched builds)
    Fixed in: Latest Office LTSC 2024 security update
  • Microsoft — Office Online Server
    Vulnerable versions: unpatched builds
    Fixed in: Latest Office Online Server security update

Remediation for CVE-2025-60727

Patches

  • Microsoft security update for CVE-2025-60727 (delivered via Microsoft 365 Apps Click-to-Run automatic update or standalone KB for Office 2019 / LTSC 2021 / LTSC 2024)

Immediate actions

  • Apply Microsoft's released security update for CVE-2025-60727 via Click-to-Run for Microsoft 365 Apps or the applicable KB package for perpetual/LTSC Office versions
  • Enable Protected View for files originating from the internet or other untrusted locations
  • Block macros and external content in Office documents via Group Policy / ADMX templates
  • Restrict receipt and opening of Excel attachments from untrusted or unexpected senders at the email gateway

Workarounds

  • Enforce Protected View for all externally-sourced Office documents
  • Disable/block Excel macros and external content by policy
  • Restrict Office Online Server rendering of documents from untrusted sources

Longer-term hardening

  • Deploy Attack Surface Reduction (ASR) rules to block Office applications from creating child processes
  • Deploy EDR with behavioral detection tuned to Office-application process-injection and child-process anomalies
  • Strengthen email filtering / attachment sandboxing (detonation chamber) for inbound Office documents
  • Establish a patch-compliance monitoring cadence for Microsoft 365 Apps / Office LTSC across the fleet

CVEs associated with CVE-2025-60727

CVE-2025-60727

Weaknesses (CWE) in CVE-2025-60727

CWE-125

Timeline of CVE-2025-60727

  • CVE-2025-60727 published by Microsoft/NVD as an out-of-bounds read (CWE-125) vulnerability in Microsoft Excel with CVSS 3.1 score 7.8
  • Vulnerability indexed by third-party vulnerability intelligence vendors (Tenable) with CVSS v2/v3 scoring and EPSS baseline
  • Microsoft Security Response Center (MSRC) advisory for CVE-2025-60727 last updated
  • Detection engineering guidance maps the primary mitigation to Microsoft Defender Attack Surface Reduction rule 'Block Office applications from creating child processes' (GUID D4F940AB-401B-4EfC-AADC-AD5F3C50688A) as the leading control against post-exploitation child-process spawning
  • Security researchers publish detection indicators (Excel spawning child processes, anomalous outbound connections, malformed OLE objects, crash telemetry) and mitigation guidance (Protected View, macro blocking, ASR rules)
  • Cyber Security News publishes technical analysis of the Microsoft 365 Apps Excel RCE vulnerability, detailing exploit mechanics and detection guidance; no active exploitation or public PoC reported at time of publication
  • CVE-2025-60727 confirmed absent from the CISA Known Exploited Vulnerabilities (KEV) catalog (2026.07.10 release, 1,637 entries), indicating no confirmed active exploitation as of this date
  • Threadlinqs Intelligence Platform ingests and documents CVE-2025-60727 as a high-signal tracking candidate given its broad Microsoft 365/Office footprint and phishing-friendly delivery model

Sources cited for CVE-2025-60727

More in vulnerability

Detection coverage for TL-2026-1205

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1205 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats