CVE-2026-55058: Microsoft 365 Apps RCE Vulnerability

CVE-2026-55058 Overview

CVE-2026-55058 is an out-of-bounds read vulnerability in Microsoft Office Excel that enables local code execution. The flaw, categorized under [CWE-125], allows an unauthorized attacker to execute arbitrary code on a targeted system when a user opens a crafted Excel file. Exploitation requires user interaction but no prior authentication.

The vulnerability affects a broad set of Microsoft Office products, including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021, Office 2024, and Office Online Server across Windows and macOS platforms. Microsoft published the advisory on 2026-07-14.

Critical Impact
Successful exploitation grants attackers arbitrary code execution in the context of the current user, enabling data theft, credential harvesting, and lateral movement within enterprise environments.

Affected Products

Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
Microsoft Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-55058 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55058

Vulnerability Analysis

CVE-2026-55058 is an out-of-bounds read [CWE-125] in the Microsoft Office Excel parsing engine. When Excel processes a maliciously crafted spreadsheet, the application reads memory beyond the allocated buffer bounds. Attackers can leverage this condition to leak sensitive memory contents or manipulate program flow, ultimately achieving code execution in the user's security context.

The attack requires the victim to open a weaponized document, typically delivered through email attachments, cloud file shares, or drive-by downloads. Because the exploit runs locally with the privileges of the logged-in user, attackers can bypass network-based controls entirely.

Root Cause

The root cause is improper bounds validation during the parsing of specific structures within an Excel workbook. When Excel encounters a malformed record, the parser dereferences memory outside the intended object boundary. This condition can be weaponized to disclose adjacent memory or corrupt process state in a way that redirects execution to attacker-controlled code.

Attack Vector

Exploitation follows a client-side attack pattern. An attacker crafts a malicious .xlsx, .xlsm, or legacy .xls file containing the triggering data structure. The file is delivered via phishing, watering-hole, or supply-chain distribution. When the target opens the document in a vulnerable Excel build, the out-of-bounds read triggers, and secondary exploitation primitives are used to gain code execution. Preview panes in mail clients can, in some configurations, also trigger the parsing path.

No public proof-of-concept exploit or exploitation in the wild has been reported at the time of this writing. The EPSS score is 0.303%.

Detection Methods for CVE-2026-55058

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, particularly cmd.exe, powershell.exe, mshta.exe, rundll32.exe, or wscript.exe.
Excel process crashes with access violation exceptions, or Windows Error Reporting entries referencing EXCEL.EXE faulting in office parsing modules.
Excel documents received from external senders containing unusual embedded objects or malformed BIFF/OOXML records.
Outbound network connections from EXCEL.EXE to previously unseen domains shortly after document open events.

Detection Strategies

Monitor process lineage for Office applications and alert on any script interpreter or LOLBin execution descending from EXCEL.EXE.
Deploy behavioral endpoint identification rules that flag memory access violations in Office processes followed by shellcode-like execution patterns.
Correlate email gateway telemetry with endpoint document-open events to identify phishing campaigns delivering weaponized spreadsheets.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and injecting into other processes.
Ingest Office telemetry and Sysmon Event ID 1 (process creation) and Event ID 11 (file create) into a centralized SIEM for cross-host correlation.
Track document provenance using Mark-of-the-Web (MOTW) attributes and alert when files opened outside Protected View trigger anomalous activity.

How to Mitigate CVE-2026-55058

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-55058 across all affected Office channels as tracked in the Microsoft Security Update Guide.
Enforce Protected View and Office File Block policies for documents originating from the internet or untrusted network zones.
Prioritize patching for endpoints belonging to high-risk user groups such as executives, finance, and HR who frequently receive external spreadsheets.

Patch Information

Microsoft has released patches addressing CVE-2026-55058 for supported Office channels. Administrators should reference the Microsoft Security Update CVE-2026-55058 advisory for build numbers and deployment guidance across Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Office Online Server. Ensure both Windows and macOS Office installations receive the update.

Workarounds

Enable Microsoft Defender ASR rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to block Office child process creation.
Disable the Outlook preview pane for external mail to prevent automatic rendering of malicious attachments.
Restrict opening of Excel files from untrusted sources by configuring File Block Settings under Trust Center to require Protected View.

bash

# Enable ASR rule to block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View for files originating from the internet (registry example)
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f