Information Disclosure in Microsoft Office Excel by Microsoft
CVE-2025-59240

5.5MEDIUM

Key Information:

Vendor

Microsoft
Status
Microsoft Office Ltsc 2021
Microsoft Office Ltsc 2024
Microsoft Office 2019
Microsoft 365 Apps For Enterprise
Vendor
CVE Published:
11 November 2025

What is CVE-2025-59240?

An information disclosure vulnerability has been discovered in Microsoft Office Excel, which could allow attackers to gain access to sensitive data. If exploited, this vulnerability permits unauthorized actors to extract confidential information stored locally within Excel files, potentially jeopardizing user privacy and data integrity. It is crucial for users and organizations to apply the necessary updates and security measures to mitigate this risk effectively.

Affected Version(s)

Microsoft 365 Apps for Enterprise 32-bit Systems 16.0.1

Microsoft Excel 2016 32-bit Systems 16.0.0.0 < 16.0.5526.1002

Microsoft Office 2019 32-bit Systems 19.0.0

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-59240 : Information Disclosure in Microsoft Office Excel by Microsoft