CVE-2026-32198: Microsoft 365 Apps Use-After-Free Flaw

CVE-2026-32198 Overview

CVE-2026-32198 is a use-after-free vulnerability [CWE-416] in Microsoft Office Excel that allows local code execution. An attacker can craft a malicious Excel document that, when opened by a user, triggers improper memory reuse and executes arbitrary code in the context of the current user. The flaw affects multiple Office distributions, including Microsoft 365 Apps, Excel 2016, Office 2019, Office Long Term Servicing Channel 2021 and 2024, and Office Online Server. Exploitation requires user interaction but no prior authentication, making weaponized spreadsheets delivered through phishing a realistic attack path.

Critical Impact

Successful exploitation grants attackers arbitrary code execution under the logged-in user's privileges, enabling malware deployment, credential theft, and lateral movement from a single opened Excel file.

Affected Products

• Microsoft 365 Apps (Enterprise, x64 and x86)
• Microsoft Excel 2016, Microsoft Office 2019
• Microsoft Office Long Term Servicing Channel 2021 and 2024 (Windows and macOS), and Microsoft Office Online Server

Discovery Timeline

• 2026-04-14 - CVE-2026-32198 published to the National Vulnerability Database (NVD)
• 2026-04-14 - Microsoft Security Update Guide advisory released for CVE-2026-32198
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-32198

Vulnerability Analysis

The vulnerability is a use-after-free condition in Microsoft Office Excel's document parsing and object handling logic. Excel frees a memory object during processing of a malformed spreadsheet, but a dangling pointer to that freed memory remains accessible to subsequent code paths. When Excel dereferences the stale pointer, an attacker who controls the contents of the reclaimed memory region can redirect execution flow. The result is arbitrary code execution within the Excel process, inheriting the privileges of the user who opened the file.

Because Excel runs with full user rights by default, successful exploitation provides a foothold suitable for installing persistence, harvesting credentials from the user profile, or staging follow-on tooling. Office Online Server inclusion in the affected list means server-side document rendering pipelines that open untrusted spreadsheets are also exposed.

Root Cause

The root cause is improper object lifetime management classified under [CWE-416] Use After Free. Excel releases a heap-allocated structure but continues to reference it through a pointer that is not invalidated. Crafted record sequences in the spreadsheet trigger the free and a subsequent reuse, allowing attacker-controlled data to occupy the freed slot before Excel reads from it.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a weaponized .xlsx, .xls, or related Office document through phishing email, a malicious download, a removable drive, or a shared collaboration platform. When a victim opens the file, Excel parses the malicious content and triggers the use-after-free. Preview pane rendering may also be a viable trigger depending on the malicious content type. No network access or elevated privileges are required from the attacker.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-32198

Indicators of Compromise

• Excel processes (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, rundll32.exe, or mshta.exe
• Office applications writing executable content, scripts, or DLLs into user-writable paths like %APPDATA%, %TEMP%, or %LOCALAPPDATA%
• Outbound network connections originating directly from EXCEL.EXE to unfamiliar external hosts shortly after a document is opened
• Crash dumps or Windows Error Reporting events referencing access violations in Excel during file open operations

Detection Strategies

• Hunt for parent-child process anomalies where Microsoft Office binaries spawn scripting interpreters or LOLBins, mapped to MITRE ATT&CK technique T1566.001
• Inspect inbound email gateways and shared file repositories for Excel attachments with unusual record structures, embedded objects, or macro-laden payloads
• Correlate Excel process crashes with subsequent suspicious activity on the same host to surface failed or partial exploitation attempts

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and executable content
• Forward Sysmon process creation, file creation, and network connection events for Office binaries into your SIEM or data lake for retrospective hunting
• Track endpoint patch compliance for Microsoft 365 Apps and Office channels to identify hosts still exposed to CVE-2026-32198

How to Mitigate CVE-2026-32198

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-32198 to all affected Office installations
• Prioritize patching for users handling external documents, such as finance, HR, procurement, and customer-facing teams
• Update Office Online Server instances that process untrusted spreadsheets on behalf of users or services
• Enforce Protected View and Block Macros from the Internet policies for Office until patching is complete

Patch Information

Microsoft has released updates addressing CVE-2026-32198 across the supported channels listed in the Microsoft Security Update Guide CVE-2026-32198. Administrators should deploy the cumulative Office security update for their channel, including Microsoft 365 Apps (Current, Monthly Enterprise, and Semi-Annual), Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office Online Server.

Workarounds

• Configure Group Policy or Intune to open files originating from the internet in Protected View and disable editing by default
• Block or quarantine Excel attachments at the email gateway when received from external or untrusted senders pending patch deployment
• Restrict execution of Office child processes using Attack Surface Reduction rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled