CVE-2026-55031: Microsoft 365 Apps RCE Vulnerability

CVE-2026-55031 Overview

CVE-2026-55031 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw affects multiple versions of Microsoft Office and Microsoft 365 Apps across Windows and macOS platforms. Exploitation requires user interaction, typically by opening a crafted Excel document. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide.

Critical Impact
A successful exploit can lead to local code execution in the context of the user opening the malicious Excel file, with high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016, Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Office Online Server and Microsoft 365 for macOS

Discovery Timeline

2026-07-14 - CVE-2026-55031 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55031

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Microsoft Office Excel parsing logic. When Excel processes a specially crafted spreadsheet, it reads memory beyond the bounds of an allocated buffer. This condition allows an attacker to influence program state and achieve local code execution in the context of the current user.

The attack requires local delivery of a malicious file and user interaction to open it. Successful exploitation grants the attacker the same privileges as the victim, enabling installation of programs, data theft, or creation of new accounts. The AV:L/UI:R attack profile aligns with document-based phishing campaigns that lure users into opening attachments.

Microsoft classifies the issue as high impact across confidentiality, integrity, and availability. The unchanged scope indicates the impact is confined to the process security context but includes full compromise of user data accessible to Excel.

Root Cause

The root cause is improper validation of input size or offset values during the parsing of an Excel document structure. Excel dereferences a pointer or index that extends past the end of a buffer, resulting in a read of adjacent memory. Attackers can shape this behavior to disclose memory contents useful for control-flow hijacking and to trigger code execution.

Attack Vector

An attacker crafts a malicious .xlsx, .xls, or related Office file that triggers the out-of-bounds read when parsed. The file is delivered through phishing email, a compromised website, a file share, or a removable device. When the victim opens the document in a vulnerable Excel build, the malformed record triggers the parsing flaw and executes attacker-controlled code.

No authentication is required, and no network access is needed beyond delivering the file to the target. Preview handlers and automatic content rendering can increase risk in some deployment configurations.

No verified public proof-of-concept code is available for CVE-2026-55031. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-55031

Indicators of Compromise

Unexpected child processes spawned from EXCEL.EXE, such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
Excel crashes or Windows Error Reporting (WER) entries referencing access violations in Office modules shortly after opening a spreadsheet.
Outbound network connections initiated by Excel to unfamiliar or newly registered domains immediately after document open.
Creation of unexpected files or scheduled tasks in user-writable directories following interaction with an Excel attachment.

Detection Strategies

Hunt for parent-child process relationships where EXCEL.EXE spawns scripting or living-off-the-land binaries.
Correlate mail gateway telemetry with endpoint file-open events to identify users who received and opened suspicious Excel attachments.
Monitor for memory access violations and abnormal thread creation inside Office processes using EDR telemetry.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and injecting into other processes.
Ingest Office telemetry, Sysmon process events, and mail security logs into a central SIEM for correlation and retrospective hunting.
Alert on Excel processes loading unusual DLLs or executing from unexpected working directories.

How to Mitigate CVE-2026-55031

Immediate Actions Required

Apply the security updates referenced in the Microsoft Security Update Guide to all affected Office and Microsoft 365 Apps installations.
Prioritize patching endpoints used by high-risk users such as executives, finance, and IT administrators.
Reinforce user awareness training focused on unsolicited Excel attachments and macro-enabled documents.

Patch Information

Microsoft has published fixes through the standard Microsoft Update channels and the MSRC advisory. Administrators should validate that the update is deployed across all channels including Microsoft 365 Apps for Enterprise, Office LTSC 2019/2021/2024, Excel 2016, Microsoft 365 for macOS, and Office Online Server. Verify patch status with Microsoft Endpoint Manager, WSUS, or Intune reporting.

Workarounds

Enable Protected View and Office Application Guard to open documents from untrusted sources in an isolated container.
Block inbound Excel attachments from external senders at the mail gateway until patches are fully deployed.
Configure ASR rules to prevent Office applications from creating executable content and spawning child processes.

bash

# Enable Attack Surface Reduction rule to block Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                                                 -AttackSurfaceReductionRules_Actions Enabled