CVE-2026-55037: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55037 Overview

CVE-2026-55037 is a heap-based buffer overflow vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute arbitrary code locally. The flaw is classified under CWE-122 and affects multiple Excel and Microsoft 365 releases across Windows and macOS platforms. Exploitation requires user interaction, typically achieved by convincing a target to open a crafted spreadsheet file. Successful exploitation yields code execution in the context of the current user, enabling attackers to install programs, modify data, or create new accounts with existing user rights.

Critical Impact
An attacker who convinces a user to open a malicious Excel document can execute arbitrary code with the privileges of the logged-on user, resulting in full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016, Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (Windows and macOS editions)
Microsoft 365 for macOS and Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-55037 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55037

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow (CWE-122) within Microsoft Excel's file parsing logic. When Excel processes a specially crafted spreadsheet, it writes data past the bounds of a heap-allocated buffer. The out-of-bounds write corrupts adjacent heap metadata or object pointers, which an attacker can shape to achieve control of execution flow. Because Office runs the parser in the user session, successful exploitation grants code execution at the user's privilege level. The bug affects both Windows and macOS builds of Excel, indicating the flawed code path resides in shared parsing logic distributed across Office builds.

Root Cause

The root cause is insufficient bounds validation when Excel copies attacker-controlled data from a spreadsheet structure into a fixed-size heap buffer. Because size fields inside the document are trusted without proper validation against the destination allocation, the copy operation overflows the buffer boundary. Microsoft has not published detailed technical internals; refer to the Microsoft Security Update CVE-2026-55037 for authoritative details.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted .xlsx, .xls, or related Excel file through phishing email, a compromised web download, a shared cloud storage link, or a collaboration platform. When the victim opens the file in a vulnerable Excel client, the malicious payload triggers the heap overflow during document parsing. The Preview Pane can also serve as a trigger surface for some Office parsing bugs, reducing the interaction required. Office Online Server is affected as well, expanding the exposure to server-side rendering of untrusted documents.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.303%.

Detection Methods for CVE-2026-55037

Indicators of Compromise

Unexpected child processes spawned from EXCEL.EXE, such as powershell.exe, cmd.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel process crashes or repeated Windows Error Reporting entries citing heap corruption in excel.exe shortly after opening a document.
Inbound spreadsheet attachments from untrusted senders that contain unusually large or malformed BIFF/OOXML structures.
Outbound network connections initiated by EXCEL.EXE to previously unseen domains or IP addresses.

Detection Strategies

Monitor process lineage for Office applications spawning script interpreters or LOLBins, a hallmark of post-exploitation from document-based RCE.
Enable Microsoft Defender Attack Surface Reduction rules that block Office child process creation and log any bypass attempts.
Deploy YARA signatures for known malicious Excel document structures against email gateways and file shares.

Monitoring Recommendations

Ingest Office telemetry, Sysmon process creation events, and EDR alerts into a centralized SIEM for correlation.
Track anomalous file writes by EXCEL.EXE to %APPDATA%, %TEMP%, and startup folders.
Alert on unsigned DLL loads within the Office process space and on new persistence entries created immediately after Office use.

How to Mitigate CVE-2026-55037

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-55037 advisory across all Windows and macOS Office installations.
Prioritize patching for users who routinely receive external spreadsheet attachments, including finance, procurement, and executive staff.
Update Office Online Server instances that render untrusted content on behalf of users.
Reinforce end-user awareness of unsolicited spreadsheet attachments and the risks of enabling content in Protected View.

Patch Information

Microsoft has issued fixes for all supported channels of Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft 365 for macOS, and Office Online Server. Consult the Microsoft Security Update Guide entry for CVE-2026-55037 for build numbers, KB identifiers, and per-channel deployment guidance. Confirm the effective Office build after deployment using File → Account → About Excel.

Workarounds

Enforce Protected View and Block macros from the internet via Group Policy to reduce the interaction surface for weaponized spreadsheets.
Configure Microsoft Defender Attack Surface Reduction rules to block Office applications from creating child processes and injecting into other processes.
Disable the Preview Pane in Outlook and Windows Explorer to reduce automatic parsing of attachments.
Use email gateway filtering to strip or sandbox .xlsx, .xlsm, .xls, and .xlsb attachments from untrusted senders until patching is complete.

bash

# Configuration example: Enable ASR rule to block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify enforcement state
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids