CVE-2026-68795: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-68795 Overview

CVE-2026-68795 is a stack-based buffer overflow [CWE-121] in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw affects Microsoft 365 Apps, Microsoft Excel 2016, Microsoft 365 on macOS, Office 2019, Office 2021, and Office 2024 across x86, x64, and macOS builds. Exploitation requires a user to open a crafted Excel file, at which point the attacker gains code execution in the context of the current user. The Common Weakness Enumeration category is CWE-121 (Stack-based Buffer Overflow), and the EPSS probability is 0.325% at the 25.2 percentile.

Critical Impact
A crafted .xlsx or .xls document opened in a vulnerable Excel build triggers stack memory corruption, giving an attacker full read, write, and execute access at the user's privilege level.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Excel 2016 (x86 and x64)
Microsoft 365 Apps on macOS
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (x86, x64, macOS)

Discovery Timeline

2026-08-11 - CVE-2026-68795 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68795

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow in Microsoft Office Excel's file parsing routines. When Excel processes a specially crafted spreadsheet, a fixed-size stack buffer receives more data than it can hold. The excess bytes overwrite adjacent stack memory, including saved return addresses, frame pointers, and structured exception handler records. An attacker who controls the overflowing data can redirect execution flow to attacker-supplied code or gadgets already present in the process image.

Successful exploitation grants code execution with the rights of the user running Excel. On workstations where users hold administrative privileges, this results in full host compromise. On standard user endpoints, attackers gain a foothold for credential theft, lateral movement, and persistence.

Root Cause

The root cause is missing or incorrect bounds validation in a stack-allocated buffer inside Excel's document parser. A length field or record size drawn from untrusted file content is used to copy data without verifying that the destination buffer can hold it. This is the textbook pattern captured by [CWE-121].

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious Excel document through email, chat, a compromised website, a removable drive, or a shared file service. When the target opens the file in a vulnerable Excel build, the parser processes attacker-controlled bytes and triggers the overflow. No network authentication is required, and the attacker does not need prior access to the target host.

The vulnerability is described in the Microsoft Security Update CVE-2026-68795 advisory. No public proof-of-concept or exploit code is currently available.

Detection Methods for CVE-2026-68795

Indicators of Compromise

Excel process (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Crashes of EXCEL.EXE recorded in the Windows Application event log with faulting module tied to document parsing.
Excel writing executable content or scripts to %TEMP%, %APPDATA%, or user profile startup paths immediately after opening a document.
Outbound network connections from EXCEL.EXE to previously unseen IP addresses or domains.

Detection Strategies

Hunt for parent-child process relationships where Office applications launch scripting engines or LOLBins shortly after document open events.
Alert on module loads of unusual DLLs into EXCEL.EXE, particularly from writable user directories.
Correlate mail gateway telemetry for .xls, .xlsx, .xlsm, and .xlsb attachments from external senders with subsequent endpoint execution events.

Monitoring Recommendations

Enable and forward Microsoft Defender AntiMalware Scan Interface (AMSI) and Office telemetry to your central logging platform.
Track Excel version and patch level across the estate to identify hosts still exposed to CVE-2026-68795.
Monitor for Windows Error Reporting entries showing repeated crashes of EXCEL.EXE, which can indicate exploitation attempts or unstable exploits.

How to Mitigate CVE-2026-68795

Immediate Actions Required

Apply the Microsoft security update referenced in Microsoft Security Update CVE-2026-68795 to all affected Office and Microsoft 365 Apps builds.
Prioritize patching on hosts that routinely open externally sourced Excel files, including finance, procurement, and executive assistant workstations.
Block inbound Excel attachments from untrusted senders at the mail gateway until patches are confirmed deployed.

Patch Information

Microsoft has issued fixed builds for Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024 on both Windows and macOS. Consult the Microsoft Security Update CVE-2026-68795 advisory for the exact build numbers per channel and platform, and validate installation using Office Click-to-Run version reporting or configuration management inventory.

Workarounds

Enforce Protected View for files originating from the internet and from Outlook attachments through Group Policy or Intune.
Enable Microsoft Office Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting into other processes.
Restrict opening of legacy binary Excel formats (.xls, .xlsb) through File Block Settings for users who do not require them.
Educate users to avoid opening unexpected spreadsheets and to report suspicious documents to the security team.

bash

# Example: enforce Office ASR rules via PowerShell to block Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

# Verify current ASR configuration
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids