CVE-2026-50678: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-50678 Overview

CVE-2026-50678 is a heap-based buffer overflow vulnerability in Microsoft Office Excel that allows a local, unauthorized attacker to disclose information. The flaw is categorized under [CWE-122] (Heap-based Buffer Overflow) and affects multiple Microsoft Office product families, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Office Online Server. Exploitation requires user interaction, typically by opening a specially crafted Excel file. Successful exploitation results in limited information disclosure from process memory, but does not impact integrity or availability.

Critical Impact
A local attacker can trigger a heap-based buffer overflow in Excel through a malicious document, leading to disclosure of sensitive in-memory data on the target system.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016, Office 2019, Office 2021 (LTSC), and Office 2024 (LTSC) on Windows and macOS
Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-50678 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-50678

Vulnerability Analysis

The vulnerability resides in Microsoft Excel's parsing logic for spreadsheet content. A heap-based buffer overflow [CWE-122] occurs when Excel processes a malformed structure inside a crafted workbook. The overflow allows adjacent heap memory to be read into a location the attacker can subsequently observe, resulting in information disclosure. The attack requires local access to the target system and user interaction to open the malicious file. The impact is limited to confidentiality, with no integrity or availability consequences reported. The EPSS probability is 0.315%, indicating a low likelihood of near-term exploitation.

Root Cause

The root cause is improper bounds checking during the allocation or copy of data into a heap buffer inside the Excel file-parsing routines. When Excel encounters an oversized or malformed record, the routine writes or reads beyond the intended buffer boundary. The out-of-bounds access exposes residual heap memory contents that may contain sensitive data belonging to the Excel process.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious Excel workbook and delivers it to the target through email, shared storage, or a download. When the user opens the file in a vulnerable Excel version, the parser triggers the heap overflow. The attacker can then extract disclosed memory contents through channels such as document fields, formulas, or error output rendered by Excel.

// No verified public proof-of-concept code is available for CVE-2026-50678.
// Refer to the Microsoft Security Response Center advisory for technical details.

Detection Methods for CVE-2026-50678

Indicators of Compromise

Excel workbooks (.xlsx, .xlsb, .xls) received from untrusted sources with unusually large or malformed BIFF/OOXML records
Unexpected Excel process crashes or Windows Error Reporting entries referencing EXCEL.EXE heap corruption
Outbound network activity from EXCEL.EXE shortly after opening an attachment

Detection Strategies

Inspect email gateways and file shares for Office documents flagged by static analyzers as containing anomalous record structures
Monitor endpoint telemetry for EXCEL.EXE child process creation or memory access anomalies following document open events
Correlate document open events with subsequent access to sensitive files or credential stores by the Excel process

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from spawning child processes
Log Office telemetry through Microsoft 365 audit logs and forward to a centralized SIEM for correlation
Alert on Excel processes performing unusual file, registry, or network operations after opening documents from external sources

How to Mitigate CVE-2026-50678

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-50678 advisory across all affected Office deployments
Prioritize patching endpoints where users frequently open Excel documents from external sources
Verify that Microsoft 365 Apps update channels are configured to receive security updates automatically

Patch Information

Microsoft has released patches for all affected products through the Microsoft Update Guide. Administrators should reference the Microsoft Security Update CVE-2026-50678 entry to identify the applicable KB articles and package versions for Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Office Online Server on both Windows and macOS platforms.

Workarounds

Enable Protected View for files originating from the Internet and other untrusted locations
Configure Office File Block policy to restrict opening of legacy Excel binary formats when not required
Instruct users to avoid opening unsolicited Excel attachments and to report suspicious files to the security team

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f