CVE-2026-62870: Microsoft Excel Use-After-Free Flaw

CVE-2026-62870 Overview

CVE-2026-62870 is a use-after-free vulnerability [CWE-416] in Microsoft Office Excel that allows an unauthorized attacker to execute arbitrary code over a network. Exploitation requires user interaction, typically by opening a malicious spreadsheet delivered through email or a web download. Successful exploitation yields code execution in the context of the current user, enabling attackers to install programs, view or modify data, or create new accounts with full user rights.

Critical Impact
An attacker who convinces a user to open a crafted Excel file can achieve remote code execution with the privileges of the logged-on user.

Affected Products

Microsoft Office Excel (see the Microsoft Security Update Guide for specific build numbers)

Discovery Timeline

2026-08-04 - CVE-2026-62870 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-62870

Vulnerability Analysis

The flaw is a use-after-free condition in Microsoft Office Excel's document parsing logic. Excel frees a memory object during processing of a specially crafted spreadsheet but retains a dangling pointer that is later dereferenced. An attacker who controls the reallocated memory region can redirect execution flow to attacker-supplied data.

Exploitation requires the target to open a malicious .xlsx, .xls, or related Office file. The Preview Pane may also serve as a trigger vector in some Office use-after-free flaws, though Microsoft's advisory should be consulted for the confirmed attack surface. Because Excel runs in the user's security context, code execution inherits the victim's privileges and access rights.

Root Cause

The root cause is improper object lifetime management within Excel's file parsing routines. A memory object is released while a reference to it remains active. When subsequent code paths dereference the stale pointer, an attacker who has groomed the heap can substitute attacker-controlled data at the freed location, resulting in arbitrary code execution.

Attack Vector

The attack vector is network-based with required user interaction. Typical delivery methods include phishing emails carrying weaponized Excel attachments, malicious documents hosted on attacker-controlled websites, and shared cloud storage links. The vulnerability does not require prior authentication or elevated privileges on the target host.

No public proof-of-concept code or exploit is currently referenced in the enriched data. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-62870

Indicators of Compromise

Unexpected EXCEL.EXE child processes such as cmd.exe, powershell.exe, wscript.exe, or mshta.exe following the opening of a spreadsheet.
Excel process crashes with access violation exceptions correlated with the opening of externally sourced documents.
Outbound network connections initiated by EXCEL.EXE to previously unseen domains or IP addresses shortly after document open events.
Newly created files in %TEMP%, %APPDATA%, or Office startup folders following spreadsheet activity.

Detection Strategies

Hunt for anomalous process lineage where EXCEL.EXE spawns scripting hosts or LOLBins, mapped to MITRE ATT&CK technique T1203 (Exploitation for Client Execution).
Inspect email gateways and web proxies for Excel file attachments originating from untrusted senders or newly registered domains.
Correlate endpoint crash telemetry with document open events to identify potential exploitation attempts, even when payloads fail.

Monitoring Recommendations

Enable Microsoft Office telemetry and forward Application and Security event logs to a centralized SIEM for correlation.
Monitor for creation of persistence artifacts under Office trusted locations, registry Run keys, and scheduled tasks after Excel activity.
Track file writes and module loads by EXCEL.EXE involving unsigned or recently modified DLLs.

How to Mitigate CVE-2026-62870

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide across all systems running Microsoft Office Excel.
Prioritize patching for users who routinely receive external Excel attachments, including finance, procurement, and executive staff.
Block or quarantine inbound Excel attachments from untrusted senders at the mail gateway until patching completes.

Patch Information

Microsoft has published guidance and update packages in the Microsoft Security Update Guide. Administrators should deploy the corresponding Office cumulative updates through Microsoft Update, WSUS, Intune, or Microsoft Configuration Manager and validate installation with the Office version reported by File > Account.

Workarounds

Enable Protected View for files originating from the internet and other untrusted locations to open documents in an isolated sandbox.
Configure Attack Surface Reduction (ASR) rules in Microsoft Defender to block Office applications from creating child processes and from injecting code into other processes.
Disable the Preview Pane and Reading Pane in Windows Explorer and Outlook to prevent inadvertent rendering of malicious spreadsheets.
Enforce Office macro and add-in restrictions via Group Policy for users who do not require them.

bash

# Example PowerShell to enable relevant Microsoft Defender ASR rules
Set-MpPreference -AttackSurfaceReductionRules_Ids `
    D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
    -AttackSurfaceReductionRules_Actions Enabled

Set-MpPreference -AttackSurfaceReductionRules_Ids `
    75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
    -AttackSurfaceReductionRules_Actions Enabled