CVE-2026-40359: Microsoft Excel Use After Free Vulnerability

CVE-2026-40359 Overview

CVE-2026-40359 is a use-after-free vulnerability [CWE-416] in Microsoft Office Excel that allows local code execution. An unauthorized attacker can execute arbitrary code on an affected system by convincing a user to open a crafted Excel document. The flaw resides in how Excel manages memory objects during document processing, where freed memory is subsequently accessed and reused. Exploitation requires user interaction but no prior privileges. Successful exploitation yields high impact on confidentiality, integrity, and availability of the target system.

Critical Impact

Attackers can achieve arbitrary code execution in the context of the current user by delivering a malicious Excel file, enabling lateral movement, data theft, and persistence.

Affected Products

• Microsoft Office Excel (refer to the Microsoft CVE-2026-40359 Advisory for the full list of affected versions)

Discovery Timeline

• 2026-05-12 - CVE-2026-40359 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-40359

Vulnerability Analysis

The vulnerability is a use-after-free condition in Microsoft Office Excel. Excel allocates and tracks numerous internal objects while parsing spreadsheets, including cell references, embedded objects, and formula structures. When an object is freed but a dangling pointer to the original memory remains accessible, subsequent operations can dereference that pointer. An attacker who controls allocator behavior through crafted document content can place attacker-influenced data into the freed slot, causing the dangling pointer to operate on attacker-controlled memory.

This condition leads to arbitrary code execution in the security context of the user opening the file. Because Excel commonly runs with standard user privileges, the immediate code execution inherits those privileges. Attackers typically chain such flaws with privilege escalation primitives to gain higher access.

Root Cause

The root cause is improper lifetime management of heap-allocated objects during Excel document processing [CWE-416]. A pointer continues to reference memory after that memory has been released to the allocator, and a later operation reads or writes through the stale reference.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted .xlsx, .xls, or related Excel-compatible file through phishing emails, file shares, web downloads, or removable media. Opening the file in a vulnerable Excel version triggers the freed-object reuse path and executes attacker-supplied code.

No verified proof-of-concept code is publicly available. Refer to the Microsoft CVE-2026-40359 Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-40359

Indicators of Compromise

• Unexpected Excel processes (EXCEL.EXE) spawning child processes such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
• Excel processes writing executable content to %TEMP%, %APPDATA%, or other user-writable directories.
• Inbound Excel attachments from untrusted senders containing embedded objects, external links, or anomalous file structure.
• Crash events for EXCEL.EXE with access violation exceptions preceding suspicious process activity.

Detection Strategies

• Hunt for parent-child process relationships where Office applications spawn scripting interpreters or living-off-the-land binaries.
• Inspect endpoint telemetry for memory access violations in EXCEL.EXE correlated with document open events.
• Monitor for outbound network connections initiated by Excel immediately after document open operations.

Monitoring Recommendations

• Forward Office process telemetry, Sysmon Event ID 1 (process create) and Event ID 11 (file create), and Windows Defender exploit guard logs to a central analytics platform.
• Enable Microsoft Office Attack Surface Reduction (ASR) rules and audit blocked or alerted events.
• Alert on Excel writing files to startup folders, scheduled task creation by Office processes, and registry persistence modifications shortly after document interaction.

How to Mitigate CVE-2026-40359

Immediate Actions Required

• Apply the security update referenced in the Microsoft CVE-2026-40359 Advisory to all systems running Microsoft Office Excel.
• Prioritize patching for users who routinely process external Excel attachments such as finance, procurement, and executive assistants.
• Block inbound Excel attachments from untrusted senders at the email gateway until patching completes.

Patch Information

Microsoft has issued a security update through the standard update channel. Review the Microsoft CVE-2026-40359 Advisory for affected build numbers and KB references, then deploy through Microsoft Update, WSUS, Intune, or Configuration Manager.

Workarounds

• Enable Protected View and Application Guard for Office to isolate documents originating from the internet and email.
• Enable Microsoft Defender ASR rules that block Office applications from creating child processes and from injecting code into other processes.
• Configure Group Policy to disable execution of macros from documents downloaded from the internet.
• Educate users to avoid opening unexpected Excel attachments and to report suspicious files to the security team.

# Configuration example: enable ASR rules via PowerShell to reduce Office abuse
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A, `
  3B576869-A4EC-4529-8536-B80A7769E899, `
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled