The version of Microsoft Office for Mac installed on the remote host is affected by multiple vulnerabilities as referenced in the may-13-2025 advisory.

  - Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
    (CVE-2025-30377, CVE-2025-30386)

  - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
    (CVE-2025-29977, CVE-2025-30393)

  - Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code     locally. (CVE-2025-29979, CVE-2025-30376)

  - Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an     unauthorized attacker to execute code locally. (CVE-2025-30375, CVE-2025-30383)

  - Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to     execute code locally. (CVE-2025-30379)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Security Updates for Microsoft Office Products (May 2025) (macOS)

high Nessus Plugin ID 236764

Version 1.2

Version 1.1

Version 1.2 May 16, 2025, 6:20 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202505161820
Version 1.1 May 16, 2025, 5:21 AM New Plugin Feed: 202505160521