CVE-2026-105718: Microsoft 365 Apps RCE Vulnerability

CVE-2026-105718 Overview

CVE-2026-105718 is an out-of-bounds read vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute arbitrary code over a network. The flaw affects multiple Office product lines including Microsoft 365 Apps, Office 2021, Office 2024, and Office Online Server across both Windows and macOS platforms. Exploitation requires user interaction, typically by opening a crafted Excel document. Microsoft published the advisory on October 13, 2026, and the issue is tracked under CWE-20: Improper Input Validation.

Critical Impact

Successful exploitation gives attackers code execution in the context of the user running Excel, enabling malware deployment, credential theft, and lateral movement.

Affected Products

• Microsoft 365 Apps (Enterprise, x64 and x86)
• Microsoft Office 2021 and Office 2024 LTSC (Windows and macOS)
• Microsoft Office Online Server and Microsoft 365 for macOS

Discovery Timeline

• 2026-10-13 - CVE-2026-105718 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-105718

Vulnerability Analysis

The vulnerability is an out-of-bounds read condition in Microsoft Excel's file parsing logic. When Excel processes a maliciously crafted spreadsheet, it reads memory beyond the bounds of an allocated buffer. Attackers can leverage this condition to leak memory contents and, when combined with controlled corruption, achieve arbitrary code execution within the Excel process.

The root issue is classified under CWE-20: Improper Input Validation. Excel fails to properly validate structural fields within document records before dereferencing them during parsing. The resulting read primitive allows attackers to bypass memory layout defenses and influence program flow.

Code runs with the privileges of the current user. On systems where users operate with administrative rights, the impact extends to full host compromise.

Root Cause

The underlying defect is improper input validation during the parsing of Excel document structures. Length, offset, or index fields embedded in a crafted file are trusted without verification against the actual size of in-memory buffers. This permits reads outside allocated memory regions.

Attack Vector

The attack vector is network-based but requires user interaction. A typical exploitation chain begins with an attacker delivering a weaponized .xlsx, .xls, or .xlsm file through phishing email, a shared cloud location, or a malicious website. When the victim opens the document in a vulnerable Excel version, parsing triggers the out-of-bounds read and the attacker's shellcode executes. The Office Online Server attack surface extends this risk to server-side rendering workloads processing untrusted spreadsheets.

No public proof-of-concept exploit has been published. See the Microsoft Security Update CVE-2026-105718 advisory for additional technical context.

Detection Methods for CVE-2026-105718

Indicators of Compromise

• Unexpected child processes spawned by excel.exe such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
• Excel processes making outbound network connections to unfamiliar domains or IP addresses shortly after document open.
• Excel crashes with access violation exceptions preceding anomalous process activity, suggesting failed or successful exploitation attempts.
• Suspicious Office documents arriving via email with macros disabled but containing crafted binary structures in sheet data.

Detection Strategies

• Monitor process ancestry trees for Office applications launching script interpreters or living-off-the-land binaries.
• Correlate Excel file open events with subsequent file writes to startup directories, scheduled task creation, or registry Run key modifications.
• Inspect inbound email attachments with sandbox detonation to identify malformed spreadsheet structures triggering parser faults.

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction (ASR) rules blocking Office applications from creating child processes and injecting code.
• Forward Office telemetry, Windows Event Logs, and EDR process events to a centralized data lake for retrospective hunting.
• Alert on Excel modules loading unsigned DLLs or exhibiting unusual heap allocation patterns during document parsing.

How to Mitigate CVE-2026-105718

Immediate Actions Required

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-105718 across all affected Office installations.
• Prioritize patching of Office Online Server instances and shared workstations handling externally sourced spreadsheets.
• Block inbound Excel attachments from untrusted senders at the mail gateway until patches are deployed.

Patch Information

Microsoft released security updates addressing CVE-2026-105718 for Microsoft 365 Apps, Office 2021 LTSC, Office 2024 LTSC, Microsoft 365 for macOS, and Office Online Server. Administrators should deploy the appropriate update through Microsoft Update, Click-to-Run update channels, or the Office Deployment Tool. Refer to the Microsoft Security Update CVE-2026-105718 advisory for build numbers and package identifiers.

Workarounds

• Enable Protected View and Office Application Guard to isolate documents originating from the internet or email.
• Configure Group Policy to block macros in Office files sourced from the internet and enforce file-type blocking in Trust Center.
• Apply ASR rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to prevent Office applications from creating child processes.

# Example: enforce the ASR rule that blocks Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A \
                 -AttackSurfaceReductionRules_Actions Enabled