CVE-2026-50675: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-50675 Overview

CVE-2026-50675 is a heap-based buffer overflow vulnerability in Microsoft Office Excel that enables local code execution. The flaw is classified under [CWE-122] and carries a CVSS 3.1 base score of 7.8. An attacker crafts a malicious spreadsheet and convinces a user to open it, triggering memory corruption in the Excel process. Successful exploitation grants the attacker code execution in the context of the current user, with full impact to confidentiality, integrity, and availability. The vulnerability affects Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021, Office 2024, and Office Online Server across Windows and macOS platforms.

Critical Impact
A single crafted Excel document opened by a user results in arbitrary code execution with the privileges of the logged-on account.

Affected Products

Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
Microsoft Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-50675 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-50675

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow inside the Microsoft Excel parsing routines. When Excel processes a malformed spreadsheet, it writes attacker-controlled data past the bounds of a heap-allocated buffer. This corrupts adjacent heap metadata or object pointers used later during document rendering. An attacker who controls the corrupted data can hijack control flow within the Excel process. Because Office frequently deserializes rich binary structures such as BIFF records, embedded objects, and cached formula results, the affected parser exposes a wide input surface. The result is local code execution under the identity of the user who opened the file.

Root Cause

The root cause is improper validation of length or size fields during parsing of Excel document structures. Excel allocates a fixed or size-derived heap buffer and then copies untrusted content without enforcing the allocation boundary. This is a classic [CWE-122] heap buffer overflow. Missing bounds checks on record-level counts or offset fields inside the spreadsheet permit the write past the intended buffer.

Attack Vector

Exploitation requires user interaction. The attacker delivers a weaponized .xlsx, .xls, or related Excel file through email, a shared drive, or a web download. When the user opens the document, Excel parses the malicious record and triggers the overflow. No network authentication is required, and the attack complexity is low. The Preview Pane can also process document content, expanding the delivery options available to an attacker.

No verified proof-of-concept code is publicly available. See the Microsoft Security Update CVE-2026-50675 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-50675

Indicators of Compromise

Excel (EXCEL.EXE) spawning unusual child processes such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe
Unexpected outbound network connections initiated by EXCEL.EXE shortly after a document is opened
Crash events or Windows Error Reporting entries referencing heap corruption in Excel modules
Files with anomalous Office record structures arriving through email gateways or shared storage

Detection Strategies

Monitor process ancestry for Office applications creating scripting or LOLBin child processes
Alert on Excel writing executable content, DLLs, or scheduled task artifacts to disk
Inspect inbound email attachments for malformed Office document structures using sandbox detonation
Correlate Excel crash telemetry with subsequent process creation and network activity on the same host

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes
Forward Sysmon Event IDs 1, 3, 7, and 11 from endpoints to a centralized analytics platform for Office-focused hunting
Track patch compliance for Office builds across managed endpoints and flag unpatched versions

How to Mitigate CVE-2026-50675

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-50675 across all affected Office installations
Prioritize patching of endpoints used by high-value users who routinely open external spreadsheets
Restrict opening of Excel files sourced from the internet by enforcing Protected View and Mark-of-the-Web policies

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Office Online Server on Windows and macOS. Consult the Microsoft Security Update CVE-2026-50675 advisory for the specific build numbers required for each channel and platform.

Workarounds

Disable the Excel Preview Pane in Outlook and Windows Explorer to prevent inadvertent parsing of untrusted files
Block or quarantine Excel attachments from external senders at the email gateway until patches are deployed
Enforce Office file block policy to prevent opening legacy binary formats such as .xls from untrusted locations

bash

# Registry example: disable Excel Preview Pane handler in Outlook
reg add "HKCU\Software\Microsoft\Office\16.0\Common\PreviewPane" /v DisableFilePreviewing /t REG_DWORD /d 1 /f

# Group Policy path for Protected View enforcement
# User Configuration > Administrative Templates > Microsoft Excel > Excel Options > Security > Protected View
#   - Enable "Turn off Protected View for attachments opened from Outlook" = Disabled
#   - Enable "Do not open files from the Internet zone in Protected View" = Disabled