CVE-2026-55025: Microsoft 365 Apps RCE Vulnerability

CVE-2026-55025 Overview

CVE-2026-55025 is a type confusion vulnerability in Microsoft Office Excel that enables local code execution. The flaw, categorized as [CWE-843] (Access of Resource Using Incompatible Type), allows an unauthorized attacker to run arbitrary code in the context of the current user. Exploitation requires user interaction, typically opening a crafted spreadsheet. Microsoft published the advisory on July 14, 2026, and the vulnerability affects supported Excel builds across Windows and macOS, including Microsoft 365 Apps, Office LTSC 2019/2021/2024, and Office Online Server.

Critical Impact
Successful exploitation grants attackers full confidentiality, integrity, and availability impact on the affected host through a single malicious Excel file.

Affected Products

Microsoft 365 Apps (x86 and x64 Enterprise; macOS)
Microsoft Excel 2016, Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024
Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-55025 published to NVD with Microsoft advisory
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55025

Vulnerability Analysis

The vulnerability is a type confusion condition ([CWE-843]) inside Excel's document parsing logic. Excel accesses a memory resource using a type incompatible with the object actually stored at that location. When the mismatched type is dereferenced, the parser interprets attacker-controlled bytes as pointers, function references, or object metadata.

An attacker crafts an Excel workbook that triggers the mismatched type access during load or during a specific worksheet interaction. Because the confusion occurs in the local Excel process, code executes with the privileges of the user opening the file. The exploit does not cross a network boundary directly, but weaponized spreadsheets are commonly delivered by email, chat, or shared drives.

Root Cause

Type confusion in Office file parsers typically stems from missing runtime checks when casting or reinterpreting embedded objects, records, or OLE structures. The affected code path trusts a type tag or index without validating it against the object's actual layout. Microsoft has not disclosed the specific record or object involved.

Attack Vector

The attack vector is local with required user interaction. An attacker sends or hosts a malicious .xlsx, .xlsm, or legacy .xls file. When the target opens the workbook, or in some cases previews it, the malformed structure triggers the type confusion and hands control to attacker-supplied shellcode or ROP chain.

No verified public proof-of-concept code is available. Refer to the Microsoft Security Response Center advisory for authoritative technical details.

Detection Methods for CVE-2026-55025

Indicators of Compromise

Excel process (EXCEL.EXE) spawning child processes such as cmd.exe, powershell.exe, rundll32.exe, mshta.exe, or wscript.exe
Unexpected outbound network connections initiated by EXCEL.EXE shortly after a document is opened
Excel crashes with access violation exceptions correlated to recently received spreadsheets
Office documents arriving from external senders that contain unusually large or malformed BIFF/OOXML records

Detection Strategies

Deploy behavioral endpoint identification rules that flag Office applications launching scripting or LOLBin processes
Enable Windows Defender Application Guard for Office and Attack Surface Reduction (ASR) rules that block child process creation from Office
Inspect email attachments and cloud storage uploads with sandbox detonation to observe abnormal parser behavior

Monitoring Recommendations

Aggregate process creation events (Sysmon Event ID 1) with parent EXCEL.EXE and correlate against user session activity
Monitor Office telemetry for repeated document open failures or crashes across multiple endpoints, which may indicate exploit development attempts
Track EPSS movement for CVE-2026-55025 (currently 0.303%, percentile 22.38) to prioritize response as exploit likelihood shifts

How to Mitigate CVE-2026-55025

Immediate Actions Required

Apply the Microsoft security updates referenced in the MSRC advisory for CVE-2026-55025 to all Excel, Microsoft 365 Apps, and Office Online Server installations
Prioritize patching endpoints used by high-risk roles such as finance, executive assistants, and external-facing staff who routinely open spreadsheets
Block or quarantine inbound Excel attachments from untrusted senders until patches are deployed

Patch Information

Microsoft has released fixed builds for Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office Online Server. Consult the Microsoft CVE-2026-55025 Advisory for the exact build numbers per channel and platform, including macOS updates.

Workarounds

Enforce Protected View and Office Protected Mode for files originating from the internet or email
Enable ASR rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to block Office applications from creating child processes
Disable legacy file format loading via Trust Center or Group Policy where business processes permit

bash

# Example: enforce ASR rule to block Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled