CVE-2026-55029: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55029 Overview

CVE-2026-55029 is a heap-based buffer overflow vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw affects multiple Microsoft Office product lines including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021, Office 2024, and Office Online Server across both Windows and macOS platforms. Exploitation requires user interaction, typically opening a crafted spreadsheet file. Microsoft published the advisory on 2026-07-14, and the issue is tracked under [CWE-122: Heap-based Buffer Overflow].

Critical Impact
Successful exploitation grants attackers arbitrary code execution in the context of the current user, enabling data theft, persistence, and lateral movement.

Affected Products

Microsoft 365 Apps (x64 and x86 enterprise editions)
Microsoft Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-55029 published to NVD
2026-07-14 - Microsoft releases security update for CVE-2026-55029
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55029

Vulnerability Analysis

The vulnerability resides in Excel's file parsing logic, where a malformed spreadsheet triggers a heap-based buffer overflow. When Excel processes attacker-controlled data structures, it writes beyond the allocated heap buffer boundary. This corruption enables an attacker to overwrite adjacent heap metadata or function pointers.

Because the attack vector is local and requires user interaction, exploitation typically follows a phishing scenario. A victim receives a weaponized .xlsx, .xls, or .xlsm file and opens it in a vulnerable Excel version. Code then executes with the privileges of the logged-in user.

The Exploit Prediction Scoring System places this issue in the 22nd percentile, indicating lower near-term exploitation likelihood compared to other Office memory corruption bugs. However, Excel parser flaws have historically appeared in commodity phishing kits shortly after disclosure.

Root Cause

The root cause is improper bounds validation during heap allocation and copy operations within Excel's document parser [CWE-122]. Insufficient length checks on embedded record structures allow untrusted input from a crafted document to control the size of data written into an undersized heap buffer.

Attack Vector

An attacker crafts a malicious Excel document containing malformed structures that trigger the overflow. The file is delivered via email attachment, cloud sharing link, or malicious website. When the victim opens the file, Excel parses the payload and the overflow executes attacker-supplied shellcode. Preview Pane rendering may also serve as a trigger for some Office file formats. No verified public proof-of-concept code is available at time of writing.

Detection Methods for CVE-2026-55029

Indicators of Compromise

Unexpected EXCEL.EXE child processes such as cmd.exe, powershell.exe, mshta.exe, rundll32.exe, or regsvr32.exe
Excel spawning network connections to untrusted external hosts shortly after document open
New files written to %APPDATA%, %LOCALAPPDATA%, or Office Startup folders following spreadsheet interaction
Crash events in Windows Event Log referencing EXCEL.EXE with faulting module addresses in heap regions

Detection Strategies

Hunt for anomalous process ancestry where Office applications spawn scripting or LOLBin binaries
Inspect inbound email attachments and cloud file shares for Excel documents containing unusually large or malformed BIFF, OOXML, or embedded object records
Correlate Office application crashes with subsequent process creation, file write, or persistence events on the same host

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules blocking Office child process creation and Win32 API calls from macros
Forward Sysmon Event IDs 1 (process create), 3 (network connect), and 11 (file create) from user workstations to a central SIEM
Monitor telemetry for repeated Excel exceptions across multiple endpoints as an early indicator of a phishing campaign

How to Mitigate CVE-2026-55029

Immediate Actions Required

Apply the Microsoft July 2026 security update for all affected Office and Microsoft 365 Apps installations without delay
Verify update deployment across managed endpoints, including macOS Office 2021, Office 2024, and Microsoft 365 installations
Restrict opening of Excel attachments from external senders and quarantine suspicious spreadsheets at the mail gateway

Patch Information

Microsoft released fixes on 2026-07-14. Deploy the vendor updates referenced in the Microsoft Security Update CVE-2026-55029 advisory through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or Configuration Manager. For Microsoft 365 Apps, ensure clients are on a supported Current Channel or Monthly Enterprise Channel build.

Workarounds

Enable Protected View and Office Application Guard to isolate untrusted documents from the host operating system
Disable Preview Pane and AutoPreview in Outlook to prevent silent rendering of malicious spreadsheets
Block macro execution from files originating from the internet using Group Policy or Intune ADMX settings

bash

# Group Policy registry keys to block internet-sourced macros in Excel
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f