CVE-2026-58618: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-58618 Overview

CVE-2026-58618 is a heap-based buffer overflow vulnerability in Microsoft Office Excel that enables local code execution. An unauthorized attacker who convinces a user to open a crafted spreadsheet can execute arbitrary code in the context of the current user. The flaw is classified under [CWE-122] Heap-based Buffer Overflow and affects multiple Microsoft Office product lines across Windows and macOS. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

Critical Impact
Successful exploitation delivers full confidentiality, integrity, and availability impact on the target host, allowing an attacker to run code with the privileges of the Excel user.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft Excel 2016, Microsoft 365 for macOS, Office Online Server
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (x64, x86, and macOS)

Discovery Timeline

2026-07-14 - CVE-2026-58618 published to the National Vulnerability Database (NVD)
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-58618

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the Microsoft Excel document parsing logic. When Excel processes a specially crafted workbook, it writes data past the boundary of a heap-allocated buffer. Attackers can leverage this out-of-bounds write to corrupt adjacent heap metadata or object pointers, redirecting execution flow.

Because the attack vector is local and requires user interaction, exploitation typically occurs when a user opens a malicious .xls, .xlsx, or .xlsm file delivered through email, chat, or a compromised website. Code runs at the privilege level of the user account launching Excel. On systems where the user holds administrative rights, the impact extends across the operating system.

Root Cause

The root cause is improper validation of the size of attacker-controlled input during allocation or copy operations inside Excel's parsing routines. This condition matches the [CWE-122] pattern where a length field or record size is trusted without adequate bounds checking before data is written to a heap buffer.

Attack Vector

Exploitation requires a local file open action by the victim. Attackers commonly deliver the malicious spreadsheet through phishing campaigns or drive-by downloads. Protected View and Mark of the Web (MOTW) enforcement reduce risk, but users who click Enable Editing on documents from untrusted sources expose Excel to the crafted payload. No prior authentication to the endpoint is required beyond the user session.

No public proof-of-concept exploit or in-the-wild exploitation has been reported at the time of NVD publication, and CISA has not added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog.

Detection Methods for CVE-2026-58618

Indicators of Compromise

Unexpected child processes spawned from excel.exe, particularly cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel processes crashing repeatedly with heap corruption exceptions (Windows Error Reporting entries referencing EXCEL.EXE and c0000374 or c0000005).
Spreadsheet files arriving from external senders with embedded objects, unusually large records, or malformed BIFF/OOXML structures.

Detection Strategies

Hunt for Office applications writing executables or scripts to %TEMP%, %APPDATA%, or %PUBLIC% directories shortly after a document open event.
Monitor for outbound network connections initiated by excel.exe to non-Microsoft domains, especially immediately following document parsing.
Correlate email gateway telemetry with endpoint file-open events to trace suspicious spreadsheets across the environment.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting code.
Collect Sysmon Event IDs 1, 7, and 11 from endpoints running Office to enable retrospective hunting.
Ingest Office telemetry and endpoint process events into a centralized SIEM for cross-source correlation.

How to Mitigate CVE-2026-58618

Immediate Actions Required

Apply the security updates referenced in the Microsoft Security Advisory across all affected Office channels.
Prioritize patching for users who routinely handle spreadsheets from external parties, including finance, procurement, and executive staff.
Verify that Microsoft 365 Apps clients are on a supported update channel and have received the July 2026 servicing release.

Patch Information

Microsoft has issued fixed builds for Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft 365 for macOS, and Office Online Server. Refer to the Microsoft Security Advisory for the specific KB numbers and version strings that remediate CVE-2026-58618.

Workarounds

Enforce Protected View and block macros from running in files originating from the internet using Group Policy.
Configure the File Block policy to prevent Excel from opening legacy binary formats (.xls, .xlt, .xla) from untrusted locations.
Train users to report unsolicited spreadsheets and disable the ability to override Protected View with a single click.

bash

# Configuration example: block Office child processes via ASR (PowerShell)
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled