CVE-2026-55044: Microsoft 365 Apps RCE Vulnerability

CVE-2026-55044 Overview

CVE-2026-55044 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw affects multiple Microsoft Office product lines including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021, Office 2024, and Office Online Server. Exploitation requires user interaction, typically by opening a specially crafted Excel document. Successful exploitation impacts confidentiality, integrity, and availability on the targeted host.

Critical Impact
An attacker who successfully exploits CVE-2026-55044 can execute arbitrary code in the context of the current user, potentially leading to full compromise of the affected workstation.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft Excel 2016 (x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, Office 2024 LTSC (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-55044 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55044

Vulnerability Analysis

CVE-2026-55044 is classified as an out-of-bounds read [CWE-125] within Microsoft Office Excel's document parsing logic. When Excel processes a malformed spreadsheet, the application reads memory outside the bounds of an allocated buffer. This out-of-bounds access can leak adjacent memory contents and, when combined with corrupted parser state, redirect execution flow to attacker-controlled data.

Because the attack vector is local and requires user interaction, exploitation typically occurs through social engineering. A victim opens a crafted .xls, .xlsx, or related Excel file delivered via email, download, or shared storage. The vulnerability yields code execution at the privilege level of the user running Excel, aligning with the high confidentiality, integrity, and availability impacts.

Root Cause

The root cause is missing or insufficient bounds checking when Excel deserializes structured records inside a spreadsheet file. A specially crafted record length or offset field causes the parser to read past the end of an allocated buffer. This condition can be leveraged to corrupt object metadata and pivot into arbitrary code execution.

Attack Vector

The attack vector is local with user interaction required. An attacker delivers a weaponized Excel document to a target and convinces them to open it. Preview Pane rendering may also serve as a trigger surface in some Office configurations. No prior authentication to the victim system is required by the attacker.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability at publication is 0.303%.

Detection Methods for CVE-2026-55044

Indicators of Compromise

Excel process (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Unexpected outbound network connections initiated by EXCEL.EXE shortly after a document is opened.
Crash dumps or Windows Error Reporting events indicating access violations in Excel modules following document open.
Excel writing executable content or scripts to user-writable directories such as %APPDATA% or %TEMP%.

Detection Strategies

Deploy behavioral endpoint detection rules that flag Office applications launching script interpreters or LOLBins.
Enable Microsoft Defender Attack Surface Reduction rules that block Office apps from creating child processes and injecting into other processes.
Correlate email gateway telemetry for inbound Excel attachments with subsequent endpoint execution events on receiving hosts.

Monitoring Recommendations

Monitor Sysmon Event ID 1 for process creation where the parent process is EXCEL.EXE.
Alert on Sysmon Event ID 11 for file writes by Excel to executable file extensions (.exe, .dll, .js, .vbs, .ps1).
Track Windows Error Reporting and application crash telemetry for Excel faulting modules to identify exploitation attempts.

How to Mitigate CVE-2026-55044

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-55044 Update Guide across all affected Office installations.
Prioritize patching endpoints that handle untrusted Excel documents, including workstations used by finance, HR, and executive assistants.
Enforce Protected View and Office File Block policies for files originating from the internet or email attachments.

Patch Information

Microsoft has released security updates addressing CVE-2026-55044 across the supported Office channels. Refer to the Microsoft Security Response Center advisory for the specific KB articles, build numbers, and channel updates applicable to each affected product, including Microsoft 365 Apps, Office LTSC 2019/2021/2024, Excel 2016, Office for Mac, and Office Online Server.

Workarounds

Enable Microsoft Defender Attack Surface Reduction rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to block Office applications from creating child processes.
Configure Office Trust Center to disable macros and block files from untrusted locations, keeping Protected View enabled for internet and Outlook attachments.
Restrict opening of Excel files received from external senders via email gateway policies until patches are deployed.

bash

# Enable ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Verify ASR configuration
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids