CVE-2024-38170: Microsoft Excel RCE Vulnerability

CVE-2024-38170 Overview

CVE-2024-38170 is a remote code execution vulnerability affecting Microsoft Excel. The flaw is classified as a heap-based buffer overflow [CWE-122] and allows attackers to execute arbitrary code in the context of the current user. Exploitation requires local access and user interaction, typically by convincing a target to open a specially crafted Excel document. Microsoft addressed the issue as part of its August 2024 Patch Tuesday release.

Critical Impact
Successful exploitation lets an attacker run code with the privileges of the logged-in user, resulting in high confidentiality and integrity impact on the affected host.

Affected Products

Microsoft 365 Apps
Microsoft Office Long Term Servicing Channel 2021 (macOS)
Related Microsoft Excel builds covered by the vendor advisory

Discovery Timeline

2024-08-13 - CVE-2024-38170 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38170

Vulnerability Analysis

CVE-2024-38170 is a heap-based buffer overflow in Microsoft Excel. When Excel parses a malformed spreadsheet, the application writes data beyond the bounds of a heap-allocated buffer. Attackers can shape the malformed content so that the overflow overwrites adjacent heap structures. This enables corruption of function pointers, virtual tables, or other control data used by Excel during document processing.

The vulnerability requires local access and user interaction. An attacker must deliver a crafted .xlsx, .xls, or related spreadsheet file to the target through email, a file share, or a download link. Opening the file in a vulnerable Excel build triggers the memory corruption. Code then executes at the privilege level of the current user.

Root Cause

The root cause is inadequate bounds checking during the deserialization of specific record structures inside an Excel workbook. Excel allocates a heap buffer sized from attacker-controlled fields, then copies attacker-controlled content into that buffer without validating length constraints. Because heap chunk metadata and neighboring objects can be corrupted, the primitive is suitable for hijacking control flow.

Attack Vector

The attack vector is local and relies on social engineering. Typical delivery methods include phishing attachments, malicious documents hosted on trusted-looking sites, and drive-by downloads. Preview panes and automatic previews in email clients may increase risk on unpatched hosts. Additional exploitation reliability is possible when Protected View is disabled or bypassed through Mark-of-the-Web weaknesses.

No public proof-of-concept is listed in the CVE record, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update CVE-2024-38170 advisory for technical details.

Detection Methods for CVE-2024-38170

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Excel writing executable content to user-writable paths like %APPDATA%, %TEMP%, or %LOCALAPPDATA%.
Outbound network connections initiated by EXCEL.EXE to previously unseen or low-reputation domains.
Crash telemetry or Windows Error Reporting events referencing heap corruption in EXCEL.EXE.

Detection Strategies

Alert on Office applications spawning script interpreters or LOLBin utilities, which is a common post-exploitation pattern.
Correlate spreadsheet-open events with subsequent process creation, file write, and network telemetry within short time windows.
Inspect email gateways for spreadsheet attachments containing anomalous embedded objects or malformed OLE streams.

Monitoring Recommendations

Ingest Sysmon Event IDs 1, 3, and 11 from endpoints into a SIEM to reconstruct Excel post-exploitation activity.
Track Office telemetry for repeated Excel crashes across users, which can indicate exploitation attempts or unstable payloads.
Monitor authentication and lateral movement events on hosts that recently opened externally sourced spreadsheets.

How to Mitigate CVE-2024-38170

Immediate Actions Required

Apply the August 2024 Microsoft security updates for Microsoft 365 Apps and Office Long Term Servicing Channel 2021 on macOS.
Inventory endpoints running Excel and confirm patched build numbers against Microsoft's advisory.
Prioritize patching for users who routinely process external spreadsheets, including finance, procurement, and HR functions.
Reinforce user awareness training focused on macro-enabled and externally sourced Office documents.

Patch Information

Microsoft released fixes for CVE-2024-38170 in the August 2024 Patch Tuesday cycle. Refer to the Microsoft Security Update CVE-2024-38170 advisory for the specific build numbers per channel, including Current Channel, Monthly Enterprise Channel, and Semi-Annual Enterprise Channel updates for Microsoft 365 Apps, plus the corresponding macOS update for Office LTSC 2021.

Workarounds

Enable and enforce Protected View for files originating from the internet and other untrusted locations.
Configure Attack Surface Reduction rules to block Office applications from creating child processes and from injecting code into other processes.
Enforce Mark-of-the-Web on downloaded and email-delivered files so Excel opens them in Protected View by default.
Restrict inbound spreadsheet attachments at the email gateway or convert them to safer formats where feasible.

bash

# Example: enable ASR rule blocking Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a `
                 -AttackSurfaceReductionRules_Actions Enabled