CVE-2026-55039: Microsoft 365 Apps RCE Vulnerability

CVE-2026-55039 Overview

CVE-2026-55039 is an integer underflow vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw is classified under [CWE-122] Heap-based Buffer Overflow, indicating the integer underflow leads to out-of-bounds heap memory corruption. Exploitation requires user interaction, typically opening a crafted Excel workbook. Microsoft rates the issue at CVSS 7.8 (HIGH). The vulnerability affects multiple supported Office releases across Windows and macOS, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Office Online Server.

Critical Impact
A successful exploit grants the attacker code execution in the context of the current user, enabling full compromise of confidentiality, integrity, and availability on the target host.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86) and Microsoft 365 for macOS
Microsoft Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-55039 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55039

Vulnerability Analysis

The vulnerability stems from an integer underflow condition in Excel's parsing of workbook data structures. When Excel processes certain size or length fields in a crafted file, an arithmetic operation wraps below zero and produces a very large unsigned value. That value is subsequently used to size or index a heap allocation, resulting in a heap-based buffer overflow ([CWE-122]).

The overflow corrupts adjacent heap metadata and object pointers within the Excel process. An attacker can leverage this corruption to hijack control flow and execute arbitrary code with the privileges of the user running Excel. Because exploitation requires the victim to open a weaponized document, this vulnerability is well-suited to phishing and targeted spear-phishing campaigns.

Root Cause

The root cause is a missing or incorrect bounds check on an untrusted length value in the Excel file parser. When the value underflows, subsequent memory operations exceed the intended buffer boundaries. CWE-122 characterizes the resulting memory safety violation on the heap.

Attack Vector

The attack vector is local (AV:L) with required user interaction (UI:R). An attacker delivers a malicious .xlsx, .xls, or related Excel file via email, web download, or shared storage. When the victim opens the file, Excel triggers the vulnerable parsing path and the attacker's payload executes in the user's security context. No prior authentication to the target system is required.

// No verified public proof-of-concept is available for CVE-2026-55039.
// See the Microsoft Security Response Center advisory for technical details.

Detection Methods for CVE-2026-55039

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel process crashes or Windows Error Reporting entries referencing heap corruption immediately after opening an untrusted spreadsheet.
Newly written executables, scripts, or scheduled tasks created in user-writable directories shortly after an Excel file was opened.
Outbound network connections from EXCEL.EXE to uncategorized or newly registered domains.

Detection Strategies

Hunt for anomalous process lineage where EXCEL.EXE is the parent of shell, script host, or LOLBins.
Alert on module loads of unusual DLLs into EXCEL.EXE from user-writable paths such as %TEMP% or %APPDATA%.
Correlate email delivery of Excel attachments with subsequent process execution and file-write telemetry on the endpoint.

Monitoring Recommendations

Ingest Microsoft Office telemetry, Sysmon process and image-load events, and EDR alerts into a centralized SIEM for correlation.
Monitor Protected View bypass attempts and Mark-of-the-Web removal from Office files staged in shared folders.
Track patch compliance for Microsoft 365 Apps, Office LTSC, and Office Online Server across the fleet.

How to Mitigate CVE-2026-55039

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-55039 Advisory to all affected Office channels.
Prioritize patching for users who routinely handle external spreadsheets, including finance, procurement, and executive assistants.
Verify that Microsoft 365 Apps update channels are not paused and that Office Online Server has received the corresponding server-side update.

Patch Information

Microsoft has published a fix through the Microsoft Security Response Center. Refer to the Microsoft CVE-2026-55039 Advisory for the specific update packages and build numbers applicable to Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Office Online Server on both Windows and macOS.

Workarounds

Keep Protected View and Office Protected Mode enabled so files from the internet, Outlook attachments, and unsafe locations open in a sandboxed context.
Enforce Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting code into other processes.
Block or quarantine inbound Excel attachments from untrusted senders at the email gateway and strip Mark-of-the-Web only for explicitly trusted sources.

bash

# Example: enable the ASR rule that blocks Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled