CVE-2025-48812 is an out-of-bounds read vulnerability in Microsoft Office Excel, affecting various Microsoft 365 and Office versions, which could allow a local, unauthorized attacker to disclose sensitive information. With a CVSS score of 5.5 (MEDIUM), exploitation requires user interaction (UI:R) and local access (AV:L), but has a high confidentiality impact (C:H). There is currently no evidence of active exploitation (KEV: No), nor are there public exploit codes available in Metasploit, Nuclei, or ExploitDB. Despite limited community discussion and media coverage, Microsoft has addressed this vulnerability in their July 2025 Patch Tuesday.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x64:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x86:* | ||
2019CPE matchmatch criteria | cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.