CVE-2026-55141: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55141 Overview

CVE-2026-55141 is a stack-based buffer overflow vulnerability [CWE-121] in Microsoft Office Excel. An unauthorized attacker can execute arbitrary code locally on affected systems by convincing a user to open a crafted spreadsheet file. The flaw affects multiple Microsoft Office product lines across Windows and macOS, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Office Online Server. Successful exploitation results in code execution in the context of the current user, with full impact on confidentiality, integrity, and availability.

Critical Impact
Attackers can achieve local code execution on any system running a vulnerable version of Microsoft Excel when a user opens a malicious spreadsheet.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016 (x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC (Windows and macOS), Office 2024 LTSC (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-55141 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55141

Vulnerability Analysis

CVE-2026-55141 is classified as a stack-based buffer overflow [CWE-121] in the Excel file parsing code path. Excel writes attacker-controlled data past the bounds of a fixed-size stack buffer when processing a crafted spreadsheet. The overflow overwrites adjacent stack memory, including saved return addresses and control structures. This corruption enables attackers to redirect execution flow and run code in the context of the Excel process.

The attack requires local execution with user interaction. A victim must open the malicious file, typically delivered via email attachment, phishing lure, or a compromised file share. No prior authentication to the target system is required beyond the ability to open the document.

Root Cause

The root cause is insufficient bounds checking on data parsed from an Excel document into a fixed-size stack buffer. When the input exceeds the declared buffer size, adjacent stack memory is overwritten. Microsoft has not published the specific parser routine involved. Refer to the Microsoft Security Update Guide for CVE-2026-55141 for vendor technical details.

Attack Vector

Exploitation begins with delivery of a weaponized .xls, .xlsx, .xlsm, or related Excel-parsable file to a target user. When the user opens the file in a vulnerable Excel client, the malicious record triggers the overflow. Because Excel runs with the privileges of the logged-in user, the attacker inherits those permissions, which is sufficient to install malware, harvest credentials, or pivot laterally.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.303%.

Detection Methods for CVE-2026-55141

Indicators of Compromise

Unexpected child processes spawned from EXCEL.EXE, particularly cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel process crashes with access violation exceptions correlated with opening spreadsheet attachments.
Outbound network connections initiated by EXCEL.EXE to previously unseen or low-reputation domains.
Creation of executables or scripts in user-writable directories such as %TEMP%, %APPDATA%, or %LOCALAPPDATA% shortly after a spreadsheet is opened.

Detection Strategies

Hunt for anomalous process trees where EXCEL.EXE is the parent of shell, scripting, or LOLBin executables.
Inspect email gateways for spreadsheets with unusual embedded objects, macros, or malformed BIFF/OOXML records.
Correlate Excel crash telemetry from Windows Error Reporting (WER) with file open events on the same host.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes.
Forward Office telemetry, Sysmon process creation events, and endpoint EDR data to a centralized SIEM for correlation.
Alert on Excel opening files from Outlook temporary directories or from internet-zone sources without Protected View.

How to Mitigate CVE-2026-55141

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide for CVE-2026-55141 across all affected Office channels.
Verify Microsoft 365 Apps client update channels are current and enforce mandatory restart to complete patch installation.
Prioritize patching for users who routinely open spreadsheets from external senders.

Patch Information

Microsoft has issued security updates for Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Microsoft 365 for macOS, and Office Online Server. Refer to the Microsoft Security Update Guide for CVE-2026-55141 for build numbers and per-channel release details.

Workarounds

Enforce Protected View for files originating from the internet, Outlook attachments, and unsafe locations.
Use Group Policy or Intune to block or restrict legacy Excel file formats where operationally feasible.
Enable ASR rule d4f940ab-401b-4efc-aadc-ad5f3c50688a to block Office applications from creating child processes.
Deliver user awareness training that discourages opening unsolicited spreadsheet attachments.

bash

# Enable the ASR rule that blocks Office from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a `
                 -AttackSurfaceReductionRules_Actions Enabled