CVE-2026-20943: Microsoft Office RCE Vulnerability

CVE-2026-20943 Overview

CVE-2026-20943 is an untrusted search path vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally. This vulnerability falls under CWE-426 (Untrusted Search Path) and represents a significant security risk for organizations using affected Microsoft Office products.

The vulnerability exploits improper handling of search paths when Microsoft Office loads dynamic libraries or executables. An attacker who can place a malicious file in a location within the application's search path can potentially achieve arbitrary code execution on the target system.

Critical Impact

Successful exploitation could allow attackers to execute malicious code with the privileges of the user running Microsoft Office, potentially leading to complete system compromise, data theft, or lateral movement within enterprise networks.

Affected Products

• Microsoft Office (specific versions to be confirmed via Microsoft advisory)
• Microsoft Office Suite components
• Windows systems running vulnerable Microsoft Office installations

Discovery Timeline

• January 13, 2026 - CVE-2026-20943 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-20943

Vulnerability Analysis

This untrusted search path vulnerability occurs when Microsoft Office searches for required DLLs or executables in directories that may be under attacker control before checking trusted system locations. When the application follows an insecure search order, it may load a malicious library planted by an attacker instead of the legitimate system component.

The local attack vector requires user interaction, meaning an attacker must convince a user to open a malicious document or place files in specific locations accessible to the Office application. Despite requiring local access and user interaction, successful exploitation results in high impact to confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of CVE-2026-20943 lies in CWE-426 (Untrusted Search Path), where the Microsoft Office application searches for critical components in directories that may be writable by unprivileged users or controlled by attackers. This occurs when:

1. The application uses relative paths instead of fully qualified paths when loading libraries
2. The current working directory is included in the search path before system directories
3. Environment variables controlling search paths are not properly validated

Attack Vector

The attack vector for this vulnerability is local, requiring the attacker to have some level of access to the target system or the ability to deliver a malicious payload to a location within the search path. Typical exploitation scenarios include:

DLL Hijacking: An attacker places a malicious DLL with a specific name in a directory that Microsoft Office searches before the legitimate system directories. When Office loads this library, the attacker's code executes with the privileges of the Office process.

Document-Based Attack: A specially crafted Office document is placed in a directory containing a malicious DLL. When the user opens the document, the accompanying malicious library is loaded.

The attack requires user interaction (opening a document or navigating to a specific directory) and has high complexity due to the need for precise file placement and timing. For detailed technical information, refer to the Microsoft CVE-2026-20943 Advisory.

Detection Methods for CVE-2026-20943

Indicators of Compromise

• Unexpected DLL files appearing in user-writable directories commonly accessed by Microsoft Office applications
• Process execution chains showing Microsoft Office applications loading libraries from non-standard locations such as Downloads, Desktop, or temporary directories
• Suspicious file creation events in directories where Office documents are stored
• Anomalous code execution or child process spawning from Office applications

Detection Strategies

• Monitor for DLL loading events from Office processes where the library path is outside standard Windows system directories (%SystemRoot%\System32, %ProgramFiles%)
• Implement application allowlisting to detect unauthorized libraries being loaded by Office applications
• Use endpoint detection and response (EDR) solutions like SentinelOne to identify suspicious process behavior and DLL injection attempts
• Configure Windows Defender Application Control (WDAC) or AppLocker policies to restrict library loading

Monitoring Recommendations

• Enable Windows Event Logging for process creation (Event ID 4688) with command line auditing to track Office application behavior
• Deploy Sysmon with configurations to capture ImageLoad events (Event ID 7) for Office processes
• Implement file integrity monitoring on directories commonly used for document storage
• Review and alert on any Office application loading DLLs from user profile directories

How to Mitigate CVE-2026-20943

Immediate Actions Required

• Apply the latest Microsoft security updates for Office as soon as they become available from Microsoft Update
• Review and restrict write permissions on directories that may be included in the application search path
• Implement application control policies to prevent unauthorized DLL loading
• Educate users about the risks of opening Office documents from untrusted sources or directories
• Enable SafeDllSearchMode via Windows registry to prioritize system directories in the search path

Patch Information

Microsoft has released security guidance for this vulnerability. Organizations should monitor the Microsoft CVE-2026-20943 Advisory for official patch information and apply updates through Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Endpoint Configuration Manager.

Verify patch deployment by checking the installed Office version against the versions listed in Microsoft's security advisory. SentinelOne customers can use Singularity platform vulnerability management features to track patch status across their environment.

Workarounds

• Enable the CWDIllegalInDllSearch registry setting to remove the current working directory from the DLL search path
• Configure Group Policy to restrict DLL loading from user-writable directories
• Use Microsoft's Enhanced Mitigation Experience Toolkit (EMET) or Windows Defender Exploit Guard to enable additional DLL loading protections
• Implement network segmentation to limit the potential impact of successful exploitation

# Registry configuration to enable SafeDllSearchMode
# Run in elevated PowerShell
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "SafeDllSearchMode" -Value 1 -Type DWord

# Optional: Block DLL loading from current working directory
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "CWDIllegalInDllSearch" -Value 1 -Type DWord