CVE-2025-60727: Microsoft 365 Apps Excel Out-of-Bounds Read Enables Remote Code Execution
CVE-2025-60727 (TL-2026-1205) is a high-severity software vulnerability scored CVSS 7.8, first published 2026-07-11. It has no confirmed attribution, affects Microsoft Microsoft 365 Apps, references 1 CVE (CVE-2025-60727), maps to 23 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-1205
- Threat ID
- TL-2026-1205
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-11
- Last reviewed
- 2026-07-11
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, manufacturing, technology, education, legal, retail
- Target regions
- North America, Europe, Asia-Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 16
An out-of-bounds read vulnerability (CWE-125) in how Microsoft Excel parses crafted spreadsheet files allows an attacker to execute arbitrary code in the context of the current user when a victim opens a malicious Excel document. No authentication or elevated privileges are required, but user interaction is mandatory; the primary delivery vector is phishing with weaponized Excel attachments.
How CVE-2025-60727 works
CVE-2025-60727 is a locally-exploitable memory-safety vulnerability (CWE-125, out-of-bounds read) in Microsoft Excel's file-parsing engine, affecting Microsoft 365 Apps (Enterprise, x86/x64), Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office Online Server on Windows and macOS. The root cause is insufficient validation of length and offset values while Excel parses internal binary/OOXML spreadsheet structures (.xls/.xlsx). When Excel processes a specially crafted file, it reads memory beyond the bounds of an allocated buffer; an attacker who controls the malformed structure can leverage this out-of-bounds read to influence subsequent execution flow and ultimately achieve arbitrary code execution running with the current user's privileges (CIA impact: High/High/High).
Exploitation requires no authentication and no elevated privileges (PR:N), but does require user interaction (UI:R) — the victim must open the malicious file — which places this squarely in the phishing-delivered document category rather than a zero-click threat. Microsoft's CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 7.8) reflects a Local attack vector because exploitation occurs through local file parsing once the file is opened on the victim's machine, with Low attack complexity and no special conditions beyond the malformed file itself.
The likely attack chain: an adversary crafts a malicious .xls/.xlsx file with malformed internal structures (e.g., anomalous OLE objects, corrupted record length/offset fields), delivers it via a phishing email disguised as an invoice, business report, or shared document, or via file-sharing/drive-by download vectors, and waits for the victim to open it in Excel (desktop client, Microsoft 365 Apps, or Office Online Server rendering). Upon opening, the parsing logic reads past the allocated buffer, corrupting adjacent memory or leaking pointer/heap layout information that the attacker's crafted payload uses to redirect execution and run arbitrary code in the security context of the logged-on user — enabling follow-on activity such as dropper execution, persistence establishment, credential access, and lateral movement.
As of the source article date (2026-06-29) there is no public proof-of-concept exploit code and no confirmed in-the-wild/active exploitation; the CVE is not present in the CISA Known Exploited Vulnerabilities (KEV) catalog (checked against the 2026-07-10 KEV release, 1,637 entries). EPSS scoring is low (~0.05-0.49% depending on source/date), consistent with a vulnerability that is patched but not yet weaponized publicly. The vulnerability was first published by NVD/MSRC on 2025-11-11 and last updated 2026-06-17. Given the broad Microsoft 365/Office product footprint, the phishing-friendly delivery model, and historical precedent of Office memory-corruption bugs being weaponized after patch analysis (n-day exploitation via patch diffing), this threat remains a high-signal tracking candidate for detection engineering and patch-compliance monitoring despite the absence of confirmed active exploitation.
MITRE ATT&CK techniques used in TL-2026-1205
Credential Access
Collection
Lateral Movement
Defense Evasion
T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Persistence
T1137 Office Application Startup; T1547 Boot or Logon Autostart Execution
Impact
Initial Access
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
T1598 Phishing for Information
defense-impairment
Affected products and versions in CVE-2025-60727
- Microsoft — Microsoft 365 Apps
Vulnerable versions: Enterprise x86; Enterprise x64
Fixed in: Apply latest Click-to-Run security update - Microsoft — Excel 2016
Vulnerable versions: 2016 (unpatched builds)
Fixed in: Latest Office 2016 security update - Microsoft — Office 2019
Vulnerable versions: 2019 (unpatched builds)
Fixed in: Latest Office 2019 security update - Microsoft — Office LTSC 2021
Vulnerable versions: LTSC 2021 (unpatched builds)
Fixed in: Latest Office LTSC 2021 security update - Microsoft — Office LTSC 2024
Vulnerable versions: LTSC 2024 (unpatched builds)
Fixed in: Latest Office LTSC 2024 security update - Microsoft — Office Online Server
Vulnerable versions: unpatched builds
Fixed in: Latest Office Online Server security update
Remediation for CVE-2025-60727
Patches
- Microsoft security update for CVE-2025-60727 (delivered via Microsoft 365 Apps Click-to-Run automatic update or standalone KB for Office 2019 / LTSC 2021 / LTSC 2024)
Immediate actions
- Apply Microsoft's released security update for CVE-2025-60727 via Click-to-Run for Microsoft 365 Apps or the applicable KB package for perpetual/LTSC Office versions
- Enable Protected View for files originating from the internet or other untrusted locations
- Block macros and external content in Office documents via Group Policy / ADMX templates
- Restrict receipt and opening of Excel attachments from untrusted or unexpected senders at the email gateway
Workarounds
- Enforce Protected View for all externally-sourced Office documents
- Disable/block Excel macros and external content by policy
- Restrict Office Online Server rendering of documents from untrusted sources
Longer-term hardening
- Deploy Attack Surface Reduction (ASR) rules to block Office applications from creating child processes
- Deploy EDR with behavioral detection tuned to Office-application process-injection and child-process anomalies
- Strengthen email filtering / attachment sandboxing (detonation chamber) for inbound Office documents
- Establish a patch-compliance monitoring cadence for Microsoft 365 Apps / Office LTSC across the fleet
CVEs associated with CVE-2025-60727
CVE-2025-60727
Weaknesses (CWE) in CVE-2025-60727
CWE-125
Timeline of CVE-2025-60727
- CVE-2025-60727 published by Microsoft/NVD as an out-of-bounds read (CWE-125) vulnerability in Microsoft Excel with CVSS 3.1 score 7.8
- Vulnerability indexed by third-party vulnerability intelligence vendors (Tenable) with CVSS v2/v3 scoring and EPSS baseline
- Microsoft Security Response Center (MSRC) advisory for CVE-2025-60727 last updated
- Detection engineering guidance maps the primary mitigation to Microsoft Defender Attack Surface Reduction rule 'Block Office applications from creating child processes' (GUID D4F940AB-401B-4EfC-AADC-AD5F3C50688A) as the leading control against post-exploitation child-process spawning
- Security researchers publish detection indicators (Excel spawning child processes, anomalous outbound connections, malformed OLE objects, crash telemetry) and mitigation guidance (Protected View, macro blocking, ASR rules)
- Cyber Security News publishes technical analysis of the Microsoft 365 Apps Excel RCE vulnerability, detailing exploit mechanics and detection guidance; no active exploitation or public PoC reported at time of publication
- CVE-2025-60727 confirmed absent from the CISA Known Exploited Vulnerabilities (KEV) catalog (2026.07.10 release, 1,637 entries), indicating no confirmed active exploitation as of this date
- Threadlinqs Intelligence Platform ingests and documents CVE-2025-60727 as a high-signal tracking candidate given its broad Microsoft 365/Office footprint and phishing-friendly delivery model
Sources cited for CVE-2025-60727
- Microsoft 365 Apps RCE Vulnerability Exploited Using a Malicious Excel File
- CVE-2025-60727 - Security Update Guide - Microsoft Excel Remote Code Execution Vulnerability
- CVE-2025-60727 Detail - NVD
- CVE-2025-60727 - Tenable
- CVE-2025-60727 - SentinelOne Vulnerability Database
- Microsoft 365 Apps RCE Vulnerability Lets Attackers Execute Code via Malicious Excel Files
- CISA Known Exploited Vulnerabilities Catalog
More in vulnerability
- Multiple Vulnerabilities in Google Chrome Patched in Stable Channel Update 154.0.8037.57 (GovCERT.HK A26-09-37)
- Microsoft Office / Microsoft 365 Apps for Enterprise Remote Code Execution Vulnerability (CVE-2026-70125)
- Multiple PHP Vulnerabilities Enable Denial of Service, TLS Verification Bypass, and Credential Leakage (CVE-2026-91765, CVE-2026-91768, CVE-2026-6103 and 8 Others) — GovCERT.HK A26-09-40
- Critical ServiceNow AI Platform Vulnerabilities: Unauthenticated SQL Injection and Authorization Bypasses (CVE-2026-13016, CVE-2026-86857-86860)
- Cross-tenant data exposure in Cloudflare Containers/Sandboxes/Browser Run via Linux dm-thin skip_block_zeroing residual block reuse
Detection coverage for TL-2026-1205
As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1205 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.