CVE-2026-47642: Microsoft 365 Apps Use-After-Free Flaw

CVE-2026-47642 Overview

CVE-2026-47642 is a use-after-free vulnerability [CWE-416] in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw affects multiple Microsoft Office product lines including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Office Online Server. Exploitation requires user interaction, typically opening a maliciously crafted Excel document. Successful exploitation grants the attacker the ability to run arbitrary code with the privileges of the current user.

Critical Impact
An attacker who convinces a user to open a specially crafted Excel file can achieve local code execution with full impact on confidentiality, integrity, and availability of the affected system.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2019, Office 2021, and Office 2024 (Windows and macOS)
Microsoft Office Online Server and Microsoft 365 for macOS

Discovery Timeline

2026-07-14 - CVE-2026-47642 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-47642

Vulnerability Analysis

The vulnerability is a use-after-free condition within Microsoft Office Excel's document parsing and rendering logic. Use-after-free flaws occur when a program continues to reference memory after it has been freed. An attacker who controls the freed memory contents can steer execution flow to attacker-supplied code.

In this case, Excel dereferences an object during spreadsheet processing after that object has already been released. The freed slot can be reoccupied by attacker-controlled data through carefully constructed spreadsheet structures, formulas, or embedded objects. Once Excel invokes a method or reads a pointer from the reused allocation, the attacker gains control of execution within the Excel process.

The attack complexity is low and no privileges are required, but user interaction is mandatory. The scope remains unchanged, and impact spans confidentiality, integrity, and availability on the local system.

Root Cause

The root cause is improper lifetime management of a heap object during Excel file processing. Excel retains a stale reference to an object after the memory has been released, violating the invariant that all pointers to freed memory be cleared or invalidated. This is classified under [CWE-416] Use After Free.

Attack Vector

Exploitation requires an attacker to deliver a weaponized Excel file to the target and convince the user to open it. Common delivery mechanisms include phishing emails with attachments, links to files hosted on external services, and files shared through collaboration platforms. Because the attack vector is local and requires user interaction, the vulnerability is well-suited to targeted spear-phishing campaigns.

Once opened, the malicious workbook triggers the use-after-free during parsing. The attacker's shellcode then executes with the privileges of the logged-in user, enabling credential theft, lateral movement, or deployment of second-stage payloads.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Response Center advisory for authoritative technical details.

Detection Methods for CVE-2026-47642

Indicators of Compromise

Unexpected EXCEL.EXE child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
Excel process crashes or WerFault.exe events correlated with opening .xls, .xlsx, .xlsm, or .xlsb attachments
Outbound network connections initiated by EXCEL.EXE to previously unseen domains or IP addresses
Creation of executable files or scripts in user-writable paths such as %APPDATA%, %TEMP%, or %LOCALAPPDATA% shortly after opening a spreadsheet

Detection Strategies

Hunt for anomalous process ancestry where Office applications spawn shell interpreters or living-off-the-land binaries
Alert on Excel loading unusual DLLs from user-writable directories or performing suspicious in-memory allocations
Monitor endpoint telemetry for exploit indicators such as heap spray patterns and ROP-style control-flow anomalies within Office processes

Monitoring Recommendations

Aggregate email gateway telemetry to identify spreadsheet attachments from external senders and correlate with subsequent endpoint activity
Track Windows Error Reporting events for repeated Excel faults across the fleet, which can indicate active exploitation attempts
Enable Microsoft Defender Attack Surface Reduction rule audit logging for Office child-process activity before enforcing block mode

How to Mitigate CVE-2026-47642

Immediate Actions Required

Apply the security updates referenced in the Microsoft Security Response Center advisory to all affected Office installations
Prioritize patching for users who routinely handle externally sourced spreadsheets, including finance, procurement, and executive assistants
Confirm Microsoft 365 Apps clients are on a supported update channel and have received the current cumulative build

Patch Information

Microsoft has released security updates for all affected products through its normal update-guide channel. Administrators should consult the Microsoft CVE-2026-47642 Update advisory for the exact build numbers corresponding to each product SKU, including Microsoft 365 Apps (x64 and x86), Office 2019, Office 2021 LTSC, Office 2024 LTSC, macOS builds, and Office Online Server.

Workarounds

Enable Protected View and Application Guard for Office to isolate documents originating from the internet or email
Enforce the Microsoft Defender Attack Surface Reduction rule that blocks Office applications from creating child processes
Configure Group Policy to block macros in files from the internet and restrict opening of untrusted Excel file formats
Train users to preview attachments in Outlook or web-based Excel before opening files locally

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled