Loading vulnerability…
Remote Code Execution in Microsoft Excel
CVE-2025-21381 is a Microsoft Excel remote code execution vulnerability caused by dereferencing an untrusted pointer. The flaw can be triggered when Excel processes a specially crafted file, and reporting indicates that the Preview Pane may also serve as an attack vector in affected scenarios. Although exploitation is described as technically local because it occurs on the victim system when the file is handled, the vulnerability is operationally remote because an unauthenticated attacker can deliver the malicious document through phishing, downloads, or other social-engineering channels and induce the target to process it. Successful exploitation can result in arbitrary code execution in the context of the user running Excel.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution on the target system in the security context of the affected user. This can enable installation of malware, unauthorized access to data available to that user, modification of local content, and use of the compromised host as a foothold for further intrusion activity. The practical severity depends on the victim's privileges and enterprise controls, but the core impact is full code execution rather than mere document-based content spoofing or disclosure.
If you can’t patch tonight, do this now.
Until patches are fully deployed, reduce exposure by blocking or strictly filtering untrusted Office documents, especially those received through email or downloaded from the internet; using Protected View and related Office hardening controls; restricting document handling from untrusted sources; and limiting use of Preview Pane where operationally feasible because it has been identified as a potential vector for multiple Excel vulnerabilities in the same release. User-awareness measures against phishing and social-engineering delivery can further reduce exploit opportunities.
Patch, then assume compromise.
Apply Microsoft's February 2025 security updates for Microsoft Excel and affected Office or Microsoft 365 installations. Organizations should prioritize deployment because Microsoft identified this issue as one of the most important Excel flaws in that release. Standard remediation includes updating all supported Excel deployments through Microsoft Update, Office update channels, or enterprise patch-management systems and verifying that vulnerable builds are no longer in use.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.