CVE-2026-56156: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-56156 Overview

CVE-2026-56156 is a heap-based buffer overflow [CWE-122] in Microsoft Office Excel. The flaw allows an unauthorized attacker to execute arbitrary code locally on a target system. Exploitation requires user interaction, typically opening a crafted Excel document. The vulnerability affects Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024 across x64, x86, and macOS builds. Microsoft published the advisory on 2026-07-14 and released a security update through the Microsoft Security Response Center.

Critical Impact
A crafted spreadsheet can trigger heap corruption in Excel, granting the attacker code execution in the context of the current user without prior authentication.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office LTSC 2021 (x64, x86, macOS)
Microsoft Office LTSC 2024 (x64, x86, macOS)

Discovery Timeline

2026-07-14 - CVE-2026-56156 published to NVD
2026-07-14 - Microsoft releases security update via MSRC
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-56156

Vulnerability Analysis

The issue is a heap-based buffer overflow [CWE-122] in the Excel parser. Excel allocates a heap buffer based on values derived from a document structure and then writes attacker-controlled data past the allocation boundary. The resulting memory corruption can overwrite adjacent heap objects, including function pointers or object headers used by later code paths. An attacker who controls the corrupted metadata can redirect execution and run arbitrary code in the current user context.

Exploitation requires the victim to open a crafted .xlsx, .xls, or related Excel file. Preview handlers can also trigger parsing on some platforms. Because execution occurs under the logged-on user, impact scales with that user's privileges. On workstations where the user holds administrative rights, the attacker gains full control of the host.

Root Cause

The root cause is insufficient bounds validation when Excel processes a length or count field inside a spreadsheet record before copying content into a heap allocation. When the parser trusts a size derived from the file rather than the actual allocation, the copy operation overruns the buffer. Microsoft has not published deeper technical detail; see the Microsoft Security Update CVE-2026-56156 advisory for authoritative information.

Attack Vector

The attack vector is local and requires user interaction. Typical delivery paths include phishing emails with a malicious attachment, downloads from a compromised website, and files staged on removable media or shared drives. Protected View reduces but does not eliminate risk, since users often disable it. No network authentication or elevated privileges are required for the attacker prior to file delivery.

No public proof-of-concept or exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.335%.

Detection Methods for CVE-2026-56156

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, particularly cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, or mshta.exe.
Excel writing executable content (.exe, .dll, .js, .hta, .lnk) to user-writable paths such as %TEMP%, %APPDATA%, or %PUBLIC%.
Excel processes making outbound network connections to previously unseen or low-reputation hosts shortly after a document is opened.

Detection Strategies

Alert on Office application process trees that deviate from baseline, especially script interpreters or LOLBins launched by EXCEL.EXE.
Monitor for module loads of unsigned or unexpected DLLs into Excel and for suspicious memory allocations with RWX protections.
Enable Microsoft Office telemetry and Attack Surface Reduction (ASR) audit events to surface blocked child process creation attempts.

Monitoring Recommendations

Ingest Windows Sysmon or EDR process, file, and network telemetry into a centralized data lake for correlation against Office-borne attacks.
Track email gateway logs for inbound Excel attachments from external senders and correlate with endpoint file-open events.
Review crash telemetry from Windows Error Reporting for Excel access violations, which can signal exploitation attempts or unstable exploits.

How to Mitigate CVE-2026-56156

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-56156 to all affected Windows and macOS installations.
Prioritize patching for users who routinely open spreadsheets received from external senders.
Confirm Microsoft 365 Apps update channels are current and force update deployment where automatic updates are delayed.

Patch Information

Microsoft has published fixes for Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024. Administrators should validate installed build numbers against the versions listed in the MSRC advisory after deployment. No workaround is a substitute for the official update.

Workarounds

Enforce Protected View and Block Macros From The Internet Group Policy settings for all Office clients.
Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from injecting into other processes.
Restrict opening of Excel files from untrusted sources at the email gateway and web proxy, and route unknown attachments through detonation sandboxes.

bash

# Example: enable ASR rule to block Office apps from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A \
                 -AttackSurfaceReductionRules_Actions Enabled