Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass Office macro policies used to block untrusted or malicious files.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
Security updates
https — https://docs.microsoft.com/en-us/officeupdates/office365-proplus-security-updates
Vulnerabilities 1
-
High 7.8
Microsoft Excel Security Feature Bypass Vulnerability
Microsoft Excel Security Feature Bypass Vulnerability
Revision history
-
#2
Added an FAQ to indicate that the Preview Pane is not affected for this CVE. This is an informational change only.
-
#1
Information published.
References
-
CVE-2025-21364 Microsoft Excel Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21364
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss