CVE-2026-55036: Microsoft 365 Apps RCE Vulnerability

CVE-2026-55036 Overview

CVE-2026-55036 is a buffer over-read vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw is classified under [CWE-126] (Buffer Over-read) and affects multiple Microsoft Office product lines, including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021, Office 2024, and Office Online Server. Exploitation requires user interaction, typically opening a crafted Excel file. Successful exploitation grants the attacker code execution in the context of the current user.

Critical Impact
Attackers can achieve local code execution by convincing a user to open a malicious Excel document, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft 365 Apps (x64 and x86 Enterprise editions)
Microsoft Excel 2016, Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS variants)
Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-55036 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55036

Vulnerability Analysis

The vulnerability originates in Excel's parsing logic for spreadsheet file formats. A buffer over-read occurs when Excel reads past the end of an allocated memory buffer while processing malformed structures within a crafted document. This condition falls under [CWE-126], where the software reads beyond the intended boundary of a buffer. Attackers can leverage the resulting memory disclosure and corruption primitives to hijack control flow and execute arbitrary code within the Excel process. Because Excel typically runs with the privileges of the interactive user, code execution inherits those privileges and can be used to install malware, exfiltrate data, or pivot deeper into the environment.

Root Cause

The root cause is insufficient validation of length or boundary values when parsing structured records inside an Excel file. When the parser trusts attacker-controlled size fields, it reads memory outside the allocated buffer. This out-of-bounds read can be combined with heap grooming to reach code execution rather than a simple crash.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a crafted Excel document through email, a web download, a shared drive, or a collaboration platform. When the victim opens the file, Excel processes the malformed content and triggers the over-read. No elevated privileges or prior authentication are required, and the attack completes in the security context of the user who opened the document.

No public proof-of-concept code has been published for CVE-2026-55036 at the time of writing. See the Microsoft Security Update CVE-2026-55036 advisory for vendor technical details.

Detection Methods for CVE-2026-55036

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Excel process crashes or Windows Error Reporting entries referencing access violations while opening .xls, .xlsx, or .xlsb files.
Outbound network connections from EXCEL.EXE to previously unseen domains or IP addresses shortly after document open.
Creation of executables or scripts in %TEMP%, %APPDATA%, or Office Startup folders following spreadsheet activity.

Detection Strategies

Hunt for process lineage where Office applications spawn command interpreters or living-off-the-land binaries.
Alert on module loads of scripting engines (vbscript.dll, jscript.dll) or COM automation within Excel from non-standard document locations.
Correlate email gateway telemetry with endpoint document-open events to identify malicious attachments delivered before code execution.

Monitoring Recommendations

Enable and forward Microsoft Defender AntiVirus, Sysmon, and Office telemetry to a centralized SIEM for behavioral analysis.
Track patch state across Microsoft 365 Apps, Office 2019/2021/2024, and Office Online Server to identify systems still exposed to CVE-2026-55036.
Monitor Attack Surface Reduction (ASR) rule events, particularly rules blocking child process creation from Office applications.

How to Mitigate CVE-2026-55036

Immediate Actions Required

Apply the security updates referenced in the Microsoft Security Update CVE-2026-55036 advisory across all affected Office channels.
Prioritize patching of systems that routinely open spreadsheets received from external senders.
Verify Office Online Server deployments are updated, as they process untrusted documents on shared infrastructure.

Patch Information

Microsoft has issued security updates for the affected products through the Microsoft Update Guide. Administrators should deploy the corresponding Click-to-Run or MSI updates for Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Office Online Server. Refer to the Microsoft Security Update CVE-2026-55036 page for build numbers and deployment channels.

Workarounds

Enable Protected View and Office Application Guard so untrusted documents open in an isolated sandbox.
Enforce Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.
Block or quarantine Excel attachments from external senders at the email gateway until patching is complete.
Train users to avoid opening unsolicited spreadsheet files and to report suspicious attachments.

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled