PT-2025-20981 · Microsoft · Office Excel+1

F4 + 1 · Published 2025-05-13 · Updated 2025-05-14 · CVE-2025-29979

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel (affected versions not specified)

Description: A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. This issue enables remote attackers to execute arbitrary code and affect the system. It is recommended to apply the May 2025 patch to resolve the issue.

Recommendations: Apply the May 2025 patch to resolve the issue. As a temporary workaround, consider restricting the use of Microsoft Office Excel until the patch is applied.

Fix

RCE

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2025-05591

CVE-2025-29979

Affected Products

Office Excel

Office

References · 9

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29979 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29979 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/720998 · Security Note
• https://bdu.fstec.ru/vul/2025-05591 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29979 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29979 · Security Note
• https://twitter.com/windowsforum/status/1922525590730457092 · Twitter Post
• https://twitter.com/CVEnew/status/1922339834389266863 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1922452251840299123 · Twitter Post