CVE-2024-38172: Microsoft Excel RCE Vulnerability

CVE-2024-38172 Overview

CVE-2024-38172 is a remote code execution vulnerability in Microsoft Excel affecting Microsoft 365 Apps and Microsoft Office Long Term Servicing Channel 2021 for macOS. The flaw is a heap-based buffer overflow [CWE-122] triggered when Excel processes a specially crafted document. Exploitation requires the target user to open a malicious file, which then allows arbitrary code execution within the user's security context. Microsoft assigned this vulnerability a CVSS score of 7.8 and published guidance through the Microsoft Security Response Center.

Critical Impact
Successful exploitation grants attackers code execution with the privileges of the current user, enabling malware installation, data theft, and lateral movement from a single opened document.

Affected Products

Microsoft 365 Apps
Microsoft Office Long Term Servicing Channel 2021 (macOS)
Microsoft Excel components bundled in the above suites

Discovery Timeline

2024-08-13 - CVE-2024-38172 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38172

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in the Microsoft Excel document parsing logic. Excel allocates a heap buffer sized from attacker-controlled fields within a crafted spreadsheet. When Excel later copies content into that buffer, it writes past the allocated bounds and corrupts adjacent heap metadata and object pointers.

An attacker who controls the overflow can overwrite function pointers or virtual table entries reachable during later parsing. This gives the attacker control of the instruction pointer and enables arbitrary code execution inside the Excel process. Code runs in the security context of the user who opened the file.

Exploitation requires user interaction, and the attack executes locally after a user opens the crafted document. No elevated privileges are needed to trigger the flaw, and the confidentiality, integrity, and availability impacts are all high per the Microsoft advisory.

Root Cause

The root cause is insufficient validation of size or length fields inside the parsed Excel file format. The parser trusts attacker-supplied values when computing buffer allocations or copy lengths, producing a mismatch between allocation and write size.

Attack Vector

An attacker crafts a malicious .xlsx, .xls, or related Excel document and delivers it through phishing email, a compromised website, or a shared file location. When the target opens the file in a vulnerable version of Excel, the parser processes the crafted structures and corrupts the heap.

The vulnerability manifests during document parsing before any macro execution, so Protected View bypasses or preview handlers may broaden the exposure surface. See the Microsoft Security Update Guide for authoritative technical scope.

Detection Methods for CVE-2024-38172

Indicators of Compromise

Excel process (EXCEL.EXE on Windows, Microsoft Excel on macOS) spawning unexpected child processes such as cmd.exe, powershell.exe, bash, or osascript
Unexpected Excel process crashes with heap corruption exceptions logged in Windows Error Reporting or macOS crash reports
Newly created executables, scripts, or LaunchAgents written to user directories shortly after an Excel document is opened
Outbound network connections from the Excel process to previously unseen domains or IP addresses

Detection Strategies

Hunt for Excel process trees that terminate in shells, script interpreters, or rundll32.exe invocations following the opening of an email attachment
Inspect inbound email attachments for Excel documents containing malformed or oversized parsing structures
Correlate Excel crash telemetry with subsequent file writes or persistence artifacts on the same host

Monitoring Recommendations

Enable command-line and process-creation auditing on endpoints running Microsoft 365 Apps and Office 2021
Forward Office telemetry, EDR process events, and email gateway attachment metadata into a centralized data lake for correlation
Alert on Excel making outbound network connections outside of documented Microsoft telemetry endpoints

How to Mitigate CVE-2024-38172

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update Guide to all instances of Microsoft 365 Apps and Office LTSC 2021
Inventory macOS and Windows endpoints running affected Office builds and prioritize patching for users who routinely receive external documents
Block or quarantine Excel attachments from untrusted senders at the email gateway until patching is verified

Patch Information

Microsoft released fixes for CVE-2024-38172 through the August 2024 Patch Tuesday updates for Microsoft 365 Apps and Microsoft Office LTSC 2021. Refer to the Microsoft Security Update Guide for the specific build numbers and channel-specific update packages.

Workarounds

Enforce Protected View for files originating from the internet and from Outlook attachments
Disable the Excel preview handler in Windows Explorer and Outlook to prevent parsing of untrusted files without explicit user action
Restrict Excel from spawning child processes using attack surface reduction rules where supported

bash

# Enable the Attack Surface Reduction rule that blocks Office applications
# from creating child processes (Windows, run as administrator)
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled