This vulnerability (CVE-2025-21364) in Microsoft 365 Apps for Enterprise allows a security feature bypass in Microsoft Excel due to improper handling of deserialization of untrusted data (CWE-502). The issue is present in version 16.0.1. The CVSS 3.1 base score is 7.8, indicating high severity with high impact on confidentiality, integrity, and availability. The attack vector is local with low attack complexity and no privileges required, but user interaction is needed. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits have been observed in the wild.

Successful exploitation could lead to complete compromise of confidentiality, integrity, and availability of the affected Microsoft Excel component within Microsoft 365 Apps for Enterprise. The vulnerability allows bypassing security features related to deserialization of untrusted data, potentially enabling an attacker to execute unauthorized code or actions.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation process server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21364 for detailed guidance and ensure their Microsoft 365 Apps for Enterprise environment is updated accordingly.