CVE-2026-26110: Microsoft 365 Apps RCE Vulnerability

CVE-2026-26110 Overview

CVE-2026-26110 is a type confusion vulnerability in Microsoft Office that allows an authenticated local attacker to execute arbitrary code. The flaw stems from accessing a resource using an incompatible type, classified under [CWE-843]. Successful exploitation grants the attacker the privileges of the user running the affected Office application. The vulnerability affects Microsoft 365 Apps, Microsoft Office 2016 and 2019, and Microsoft Office Long Term Servicing Channel (LTSC) 2021 and 2024 across Windows, macOS, and Android distributions. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

Critical Impact
Local code execution with high impact to confidentiality, integrity, and availability when a user opens a crafted Office document.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2016 and 2019 (x64, x86, Android)
Microsoft Office LTSC 2021 and 2024 (Windows x64/x86, macOS)

Discovery Timeline

2026-03-10 - CVE-2026-26110 published to NVD
2026-03-13 - Last updated in NVD database

Technical Details for CVE-2026-26110

Vulnerability Analysis

The vulnerability is a type confusion flaw [CWE-843] in Microsoft Office. Type confusion occurs when code allocates or initializes an object as one type, but later accesses it through a pointer or interface assuming a different, incompatible type. The mismatch lets attacker-controlled data be interpreted as a different structure, often including pointers or function references, which the application then dereferences or invokes.

In Microsoft Office, attackers typically deliver this kind of flaw through a crafted document (DOCX, XLSX, RTF, or similar) containing malformed objects, embedded controls, or parser inputs that trigger the incorrect type cast. When the user opens the file, the Office process performs the unsafe access and transfers control to attacker-supplied logic. The result is arbitrary code execution in the security context of the current user.

The attack requires local access and low-privileged authentication, with no user interaction beyond opening the document in the targeted session.

Root Cause

The root cause is improper validation of object type prior to access. Office code paths treat one in-memory representation as another compatible type without verifying the actual structure, allowing attacker-controlled bytes to be interpreted as pointers, vtables, or length fields.

Attack Vector

An attacker authenticates locally and induces the target Office application to process a malicious file. The file embeds objects engineered to trigger the type confusion during parsing or rendering. Microsoft has not published a public proof of concept, and no exploit is currently listed in Exploit-DB or the CISA Known Exploited Vulnerabilities catalog.

No verified public exploit code is available. Refer to the Microsoft CVE-2026-26110 Update Guide for vendor technical details.

Detection Methods for CVE-2026-26110

Indicators of Compromise

Unexpected child processes spawned from winword.exe, excel.exe, powerpnt.exe, or outlook.exe, especially shells, scripting hosts, or rundll32.exe.
Office processes writing executables, scripts, or DLLs to user-writable paths such as %TEMP%, %APPDATA%, or Public directories.
Crash or Watson reports referencing access violations inside Office binaries shortly after a document was opened.
Outbound network connections initiated directly by Office processes to previously unseen domains or IP addresses.

Detection Strategies

Monitor Office applications for process injection, memory protection changes (VirtualProtect to RWX), and abnormal module loads.
Build behavioral identifications for Office spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, or regsvr32.exe.
Correlate file delivery events (email attachments, browser downloads) with subsequent Office process anomalies on the same endpoint.

Monitoring Recommendations

Centralize Sysmon process, image-load, and file-create telemetry from endpoints running Office and alert on Office-process anomalies.
Review Microsoft Defender for Endpoint or equivalent EDR telemetry for exploitation patterns associated with Office type confusion classes.
Track patch deployment status for Microsoft 365 Apps and Office LTSC builds across the fleet to identify unpatched hosts.

How to Mitigate CVE-2026-26110

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-26110 to all affected Office installations.
Prioritize endpoints used by high-value users, administrators, and developers, where local code execution has the broadest blast radius.
Validate that Microsoft 365 Apps update channels are current and that Office LTSC 2021 and 2024 installations have received the corresponding cumulative update.

Patch Information

Microsoft has released fixes through the Microsoft Update channel. Consult the Microsoft CVE-2026-26110 Update Guide for the specific build numbers per product and platform, including Windows, macOS, and Android variants of Microsoft Office.

Workarounds

Enable Protected View and Application Guard for Office to isolate untrusted documents until patches are deployed.
Block macros and OLE content from documents originating from the internet using Group Policy or Intune configuration profiles.
Restrict opening of Office attachments from external senders through mail gateway policies and Attack Surface Reduction (ASR) rules.
Train users to avoid opening unsolicited Office files and to report suspicious attachments to the security team.

bash

# Example ASR rule enabling block of Office child process creation (PowerShell)
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled