CVE-2026-20950: Microsoft 365 Apps Use-After-Free Flaw

CVE-2026-20950 Overview

CVE-2026-20950 is a use-after-free vulnerability [CWE-416] in Microsoft Office Excel that enables local code execution. An attacker who crafts a malicious spreadsheet can trigger memory corruption when a victim opens the file in a vulnerable Excel version. Successful exploitation runs arbitrary code in the context of the current user.

The flaw affects Microsoft 365 Apps, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office Long Term Servicing Channel (LTSC) 2021 and 2024, and Microsoft Office Online Server. Exploitation requires user interaction but no authentication.

Critical Impact

A specially crafted Excel document can grant attackers full code execution with the victim's privileges, enabling credential theft, lateral movement, and ransomware staging.

Affected Products

• Microsoft 365 Apps (Enterprise, x86 and x64)
• Microsoft Excel 2016, Microsoft Office 2019
• Microsoft Office LTSC 2021, LTSC 2024 (Windows and macOS), and Office Online Server

Discovery Timeline

• 2026-01-13 - CVE-2026-20950 published to the National Vulnerability Database (NVD)
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2026-20950

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in Microsoft Excel's document parsing logic. Excel frees a memory object during spreadsheet processing but retains a dangling reference that the application later dereferences. When the freed memory is reallocated with attacker-controlled data, the stale reference leads to corruption of program state.

Attackers leverage this primitive to overwrite function pointers, virtual table entries, or other control-flow data structures. The result is arbitrary code execution under the privileges of the user opening the document. The local attack vector and required user interaction align with the typical Office document exploitation chain delivered through phishing.

Root Cause

The root cause is improper object lifetime management within Excel's parsing routines. A heap object is released while a pointer referencing it remains active. Subsequent operations on the freed object allow an attacker to influence heap layout and corrupt memory in a controllable manner.

Attack Vector

Exploitation requires delivering a malicious .xlsx, .xls, or related Office file to a target. Common delivery channels include phishing emails with attachments, links to cloud-hosted documents, and compromised file shares. The victim must open the file in a vulnerable Excel build to trigger the use-after-free. No verified public proof-of-concept code is available at the time of publication.

For authoritative technical details, refer to the Microsoft Security Update Guide for CVE-2026-20950.

Detection Methods for CVE-2026-20950

Indicators of Compromise

• Excel processes (EXCEL.EXE) spawning unusual child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
• Unexpected outbound network connections initiated by Office processes shortly after opening an attachment
• Office applications writing executables, scripts, or scheduled task artifacts to disk under user profile paths
• Crash events for EXCEL.EXE referencing access violations during document load

Detection Strategies

• Hunt for parent-child relationships where EXCEL.EXE launches script interpreters or living-off-the-land binaries
• Inspect inbound email attachments and SharePoint uploads for spreadsheets containing anomalous embedded objects or external references
• Correlate Office crash telemetry (Windows Error Reporting, Application event log) with subsequent process or network activity

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes
• Forward Sysmon process creation, image load, and network connection events to a centralized SIEM for correlation
• Track Office version inventory across endpoints to confirm patch deployment status and flag outliers

How to Mitigate CVE-2026-20950

Immediate Actions Required

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-20950 across all affected Office channels
• Prioritize patching endpoints used by high-risk users such as finance, executives, and IT administrators
• Enable Protected View and Block Macros from the Internet through Group Policy for Office applications

Patch Information

Microsoft has released security updates for Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office Online Server. Administrators should deploy patches through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or Configuration Manager. Validate update installation by checking the Office build number against the version listed in the MSRC advisory.

Workarounds

• Configure Attack Surface Reduction rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to block Office applications from creating child processes
• Open untrusted spreadsheets only in Protected View or Office for the web until patches are deployed
• Restrict execution of Office macros from untrusted sources using Group Policy

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled