CVE-2026-26110: Microsoft Office RCE Vulnerability

CVE-2026-26110 Overview

A type confusion vulnerability (CWE-843) has been identified in Microsoft Office that allows an unauthorized attacker to execute arbitrary code locally. This vulnerability occurs when the application accesses a resource using an incompatible type, leading to memory corruption that can be exploited for code execution.

Critical Impact

This type confusion vulnerability enables local code execution without requiring any privileges or user interaction, potentially allowing attackers to compromise systems with Microsoft Office installed.

Affected Products

• Microsoft Office (specific versions to be confirmed via Microsoft Security Update Guide)

Discovery Timeline

• March 10, 2026 - CVE-2026-26110 published to NVD
• March 11, 2026 - Last updated in NVD database

Technical Details for CVE-2026-26110

Vulnerability Analysis

CVE-2026-26110 is a type confusion vulnerability affecting Microsoft Office applications. Type confusion occurs when a program allocates or accesses a resource using one type but subsequently operates on it as if it were a different, incompatible type. In the context of Microsoft Office, this can occur during document parsing or object handling operations where complex data structures are processed.

The vulnerability requires local access to exploit but does not require any specific privileges or user interaction, making it particularly concerning for environments where users regularly open documents from various sources.

Root Cause

The root cause of this vulnerability lies in improper type handling within Microsoft Office's object processing routines. When the application encounters certain malformed or specially crafted data structures, it fails to properly validate the type of object being accessed before performing operations on it. This leads to memory being interpreted incorrectly, which an attacker can leverage to achieve code execution.

Type confusion vulnerabilities in document processing applications like Microsoft Office typically manifest in OLE (Object Linking and Embedding) handling, custom XML processing, or embedded object parsing where multiple object types may be encountered.

Attack Vector

The attack vector for CVE-2026-26110 is local, meaning an attacker would need to deliver a malicious document to the target system and have it opened by Microsoft Office. Common delivery mechanisms include:

• Phishing emails with malicious document attachments
• Compromised file shares or document repositories
• Downloaded files from untrusted sources

Once the malicious document is opened by Microsoft Office, the type confusion is triggered, allowing the attacker to execute arbitrary code in the context of the current user. The vulnerability does not require elevated privileges to exploit, though the impact depends on the privileges of the user running Microsoft Office.

For detailed technical information, refer to the Microsoft Security Response Center advisory.

Detection Methods for CVE-2026-26110

Indicators of Compromise

• Unusual Microsoft Office process behavior, including unexpected child processes spawned from WINWORD.EXE, EXCEL.EXE, or POWERPNT.EXE
• Office applications crashing or exhibiting memory corruption symptoms when opening specific documents
• Suspicious documents with unusual embedded objects or malformed structure
• Evidence of code execution originating from Office application processes

Detection Strategies

• Monitor for anomalous behavior from Microsoft Office processes using endpoint detection and response (EDR) solutions
• Implement application control policies to detect unauthorized code execution from Office applications
• Deploy SentinelOne's behavioral AI to detect type confusion exploitation attempts through memory anomaly detection
• Use file integrity monitoring to detect suspicious document files before they are opened

Monitoring Recommendations

• Enable detailed logging for Microsoft Office applications to capture process creation events
• Monitor Windows Event Logs for application crashes or exceptions in Office processes
• Implement network monitoring to detect exfiltration attempts following successful exploitation
• Configure SentinelOne policies to alert on suspicious process chains originating from Office applications

How to Mitigate CVE-2026-26110

Immediate Actions Required

• Apply Microsoft security updates as soon as they become available through Windows Update or WSRC
• Enable Protected View in Microsoft Office to open documents from untrusted sources in a sandboxed environment
• Implement email filtering to quarantine suspicious Office documents
• Educate users about the risks of opening documents from unknown or untrusted sources

Patch Information

Microsoft has published details about this vulnerability in their Security Update Guide. Administrators should consult the Microsoft CVE-2026-26110 Details page for specific patch information, affected product versions, and security update deployment guidance.

Organizations using Microsoft Office should prioritize applying the relevant security updates through their standard patch management processes.

Workarounds

• Enable Protected View for all documents originating from external sources by navigating to File → Options → Trust Center → Trust Center Settings → Protected View
• Implement Office Application Guard (available in Microsoft 365 E5 or Windows 10/11 Enterprise) to isolate document processing
• Configure Group Policy to restrict macro execution and embedded object handling in Office documents
• Consider using Microsoft Defender Application Guard for Office to open untrusted documents in an isolated container

# PowerShell: Enable Protected View via Registry for Office applications
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" -Name "DisableAttachementsInPV" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value 0 -Type DWord