CVE-2026-68804 Overview
CVE-2026-68804 is a numeric truncation error in Microsoft Office Excel that enables local code execution. An attacker crafts a malicious spreadsheet and convinces a user to open it in a vulnerable Excel build. When Excel parses the file, truncated numeric values corrupt heap memory [CWE-122], allowing execution of attacker-controlled code in the user's context.
The flaw affects Microsoft 365 Apps, Microsoft Excel 2016, Microsoft 365 on macOS, Office 2019, Office LTSC 2021, and Office LTSC 2024 across x86, x64, and macOS builds. User interaction is required, but no privileges or authentication are needed to trigger the condition.
Critical Impact
Successful exploitation grants arbitrary code execution with the logged-in user's privileges, providing a foothold for credential theft, lateral movement, and payload delivery through weaponized Excel documents.
Affected Products
- Microsoft 365 Apps (Enterprise, x64 and x86)
- Microsoft Excel 2016 (x64 and x86); Microsoft 365 for macOS
- Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (x64, x86, macOS)
Discovery Timeline
- 2026-08-11 - CVE-2026-68804 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68804
Vulnerability Analysis
The vulnerability is a numeric truncation error [CWE-122] in Excel's document parsing logic. Excel reads a wide integer value from a crafted spreadsheet structure and stores it into a narrower type used for a heap allocation size or offset calculation. The truncated value bypasses length checks that operated on the untruncated input.
Excel then performs a heap-based write using the original untruncated length or index. The mismatch produces an out-of-bounds write beyond an allocated buffer on the heap. Corrupting adjacent heap metadata or object pointers redirects control flow during subsequent processing.
Exploitation requires local delivery of the malicious workbook and user interaction to open it. The attacker gains code execution in the Excel process with the user's rights.
Root Cause
The root cause is unsafe narrowing of a size or index field parsed from the file. Validation is performed on the truncated value while the full-width value drives the memory operation. The disparity produces the heap corruption tracked as [CWE-122].
Attack Vector
Delivery occurs through phishing email attachments, malicious downloads, shared drives, or collaboration platforms. Opening the crafted .xlsx, .xlsm, or .xls file in an unpatched Excel build triggers the parsing path and completes the exploit chain. See the Microsoft Security Advisory CVE-2026-68804 for technical details published by the vendor.
Detection Methods for CVE-2026-68804
Indicators of Compromise
- Excel process (EXCEL.EXE) spawning child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
- Unexpected crashes or Windows Error Reporting entries for EXCEL.EXE referencing heap corruption during document open.
- Outbound network connections initiated by EXCEL.EXE to unfamiliar domains or IPs immediately after a workbook is opened.
- Creation of executable content in user-writable paths (%APPDATA%, %TEMP%, %LOCALAPPDATA%) sourced from an Office process.
Detection Strategies
- Hunt for suspicious parent-child process relationships where an Office application launches scripting or LOLBin binaries.
- Correlate email gateway telemetry with endpoint file writes to identify inbound Excel attachments that lead to process creation.
- Inspect Office documents at rest and in transit for anomalous binary structures, oversized records, and malformed stream headers.
Monitoring Recommendations
- Forward Sysmon Event IDs 1, 3, 7, and 11 from endpoints running Office to a central analytics platform for baselining Excel behavior.
- Alert on Excel loading unsigned or newly observed DLLs, and on network connections originating from Office processes.
- Track Office ADMX telemetry for macro-enabled and external content prompts to identify high-risk user behavior.
How to Mitigate CVE-2026-68804
Immediate Actions Required
- Apply the Microsoft security updates referenced in the Microsoft Security Advisory CVE-2026-68804 to all affected Excel and Office builds.
- Enable Protected View and Application Guard for Office to isolate untrusted workbooks from the host operating system.
- Block or quarantine Excel attachments from external senders at the mail gateway until patches are deployed.
- Restrict Office child process creation using Microsoft Defender Attack Surface Reduction rules.
Patch Information
Microsoft has published fixed builds through the Microsoft Update channel and the Office click-to-run servicing streams. Administrators should verify installed build numbers against the fixed versions listed in the Microsoft Security Advisory CVE-2026-68804 and confirm deployment across Windows and macOS endpoints.
Workarounds
- Enforce Protected View for files originating from the Internet, Outlook attachments, and unsafe locations through Group Policy.
- Disable ActiveX controls and legacy binary file formats where business processes permit.
- Use File Block policy in the Trust Center to prevent opening legacy Excel formats until patching is complete.
# Enable ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
# Enforce Protected View for files from the Internet (per-user registry)
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
