CVE-2026-68805: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-68805 Overview

CVE-2026-68805 is a heap-based buffer overflow [CWE-122] in Microsoft Office Excel that allows an unauthenticated attacker to execute code locally on the target system. Exploitation requires user interaction, typically opening a crafted Excel document. The flaw affects multiple Microsoft Office product families across Windows and macOS, including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC. Successful exploitation yields full impact on confidentiality, integrity, and availability within the user context.

Critical Impact
A crafted Excel file can trigger heap corruption and lead to arbitrary code execution in the context of the user opening the document.

Affected Products

Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
Microsoft Excel 2016 (x64/x86) and Microsoft Office 2019 (x64/x86)
Microsoft Office 2021 LTSC and Office 2024 LTSC (Windows x64/x86 and macOS)

Discovery Timeline

2026-08-11 - CVE-2026-68805 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68805

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Microsoft Excel's document parsing logic. An attacker crafts an Excel workbook containing malformed structures that cause Excel to write beyond the bounds of a heap-allocated buffer. The out-of-bounds write corrupts adjacent heap metadata or object pointers, giving the attacker a path to hijack control flow. Because the attack executes in the context of the user opening the file, code runs with that user's privileges. The exploitation path requires local file handling and user interaction, so the primary delivery mechanisms are phishing emails, malicious file shares, and drive-by document downloads.

Root Cause

The defect is categorized under [CWE-122] Heap-Based Buffer Overflow. It stems from insufficient validation of size parameters or record boundaries within Excel's parser, allowing attacker-controlled data to exceed the target allocation. Details of the specific parser component have not been published by Microsoft.

Attack Vector

An attacker delivers a weaponized .xls, .xlsx, or related Office document to the victim. When the file is opened in a vulnerable Excel build, the parser processes the malicious content and triggers heap corruption. Attackers commonly chain this class of flaw with sandbox or Protected View escapes to broaden impact. No network access to Excel is required; the exposure is local to the machine processing the document.

No public proof-of-concept code is available for CVE-2026-68805 at the time of publication. Consult the Microsoft Security Update CVE-2026-68805 advisory for authoritative technical details.

Detection Methods for CVE-2026-68805

Indicators of Compromise

Excel process (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Unexpected Excel crashes with heap corruption faults (c0000374, c0000005) followed by suspicious process activity.
Office documents arriving from external senders that contain obfuscated formulas, embedded objects, or unusually large binary records.
Outbound network connections initiated by Excel to previously unseen domains or IP addresses shortly after document open.

Detection Strategies

Alert on Office applications creating scripting interpreters or LOLBins as child processes, aligned with MITRE ATT&CK T1204.002 (Malicious File) and T1059 (Command and Scripting Interpreter).
Correlate Excel crash telemetry with subsequent process creation, file writes to %TEMP%, or persistence artifacts in Run keys and scheduled tasks.
Inspect email gateway logs for Excel attachments with anomalous macro flags, external template links, or DDE payloads.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and injecting into other processes.
Forward Sysmon Event ID 1 (Process Create) and Event ID 11 (File Create) from user endpoints to a SIEM for behavioral analysis.
Track opened document paths via Office telemetry and correlate with endpoint alerts to identify the initial infection vector.

How to Mitigate CVE-2026-68805

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-68805 advisory across all Office channels, including Current Channel, Monthly Enterprise Channel, and Semi-Annual Channel builds.
Prioritize patching workstations used by users who routinely open documents from external parties, such as finance, HR, and executive assistants.
Verify patch deployment on macOS Office installations, which are frequently missed in Windows-focused patch cycles.

Patch Information

Microsoft has released fixes through the standard Office update channels. Consult the vendor advisory at Microsoft Security Update CVE-2026-68805 for the specific build numbers per product and channel. Ensure that update policies (Click-to-Run, WSUS, Intune, or Microsoft AutoUpdate for macOS) are actively delivering the patched builds.

Workarounds

Enforce Protected View and Office Application Guard for documents originating from the internet or email attachments.
Configure Microsoft Defender Attack Surface Reduction rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to block Office child process creation until patching completes.
Block or quarantine legacy Excel binary formats (.xls, .xlsm) at the email gateway when business justification is absent.
Restrict opening of Excel files from untrusted network locations via File Block Settings in the Trust Center.

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A \
  -AttackSurfaceReductionRules_Actions Enabled

# Verify Office Click-to-Run update channel and trigger update
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user