CVE-2026-78518: Microsoft 365 Apps RCE Vulnerability

CVE-2026-78518 Overview

CVE-2026-78518 is an out-of-bounds read vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute code over a network. The flaw affects multiple Excel and Microsoft Office versions across Windows and macOS, including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC. Exploitation requires user interaction, typically opening a crafted spreadsheet. Microsoft classifies the issue under CWE-20: Improper Input Validation and published guidance through the Microsoft Security Update Guide.

Critical Impact

Successful exploitation grants remote code execution in the context of the current user, enabling attackers to install programs, view or alter data, and create new accounts with the victim's rights.

Affected Products

• Microsoft 365 Apps (Enterprise, x86 and x64) and Microsoft 365 for macOS
• Microsoft Excel 2016 (x86 and x64) and Microsoft Office 2016, 2019
• Microsoft Office 2021 LTSC and Office 2024 LTSC (Windows x86/x64 and macOS)

Discovery Timeline

• 2026-09-08 - CVE-2026-78518 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78518

Vulnerability Analysis

The vulnerability originates in Excel's parsing of spreadsheet file structures. When Excel processes a maliciously crafted document, it reads memory outside the bounds of an allocated buffer. This out-of-bounds read condition can be leveraged to execute arbitrary code within the Excel process. The attack requires no privileges and executes over a network, but the target user must open the crafted file for exploitation to succeed. Microsoft attributes the weakness to CWE-20: Improper Input Validation, indicating that Excel fails to properly validate structural fields inside spreadsheet content before dereferencing them.

Root Cause

The root cause is insufficient validation of length or offset fields inside an Excel document. When the parser trusts an attacker-controlled value, it reads past the boundary of the intended buffer. Attackers combine this primitive with layout knowledge of adjacent structures to influence control flow and stage code execution.

Attack Vector

An attacker delivers a specially crafted Excel workbook through email, a link, a messaging platform, or a compromised file share. When the victim opens the attachment in a vulnerable Excel build, the parser triggers the out-of-bounds read and hands execution to attacker-influenced data. The Preview Pane can also serve as an attack surface for Office file format vulnerabilities of this class. Because scope is unchanged, code runs with the same rights as the signed-in user.

No verified public exploit code is available at the time of publication. Refer to the Microsoft Security Update Guide entry for CVE-2026-78518 for authoritative technical details.

Detection Methods for CVE-2026-78518

Indicators of Compromise

• Excel processes (EXCEL.EXE) spawning unusual child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
• Excel writing executable content to user-writable paths like %APPDATA%, %TEMP%, or %PUBLIC%.
• Outbound network connections initiated by Excel to previously unseen or low-reputation domains shortly after a document is opened.
• Unexpected DLL loads or crashes in EXCEL.EXE recorded in Windows Error Reporting.

Detection Strategies

• Hunt for Office parent-child process anomalies using MITRE ATT&CK technique T1566.001 (Spearphishing Attachment) as a guide.
• Inspect email gateways for .xls, .xlsx, .xlsm, and .xlsb attachments carrying obfuscated content or macro shells.
• Correlate Office telemetry with EDR alerts for in-memory execution, injected threads, or newly created scheduled tasks tied to Excel sessions.

Monitoring Recommendations

• Enable Microsoft Defender for Office 365 Safe Attachments and Safe Links, or an equivalent third-party sandbox, for inbound documents.
• Ingest Sysmon Event IDs 1, 7, 11, and 22 for Office binaries into the SIEM and build alerts on suspicious child process trees.
• Continuously monitor for Excel builds that remain below the patched version across managed endpoints.

How to Mitigate CVE-2026-78518

Immediate Actions Required

• Deploy the September 2026 Microsoft security updates for Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC as listed in the MSRC advisory.
• Prioritize patch rollout to users who routinely handle external spreadsheets, including finance, procurement, and executive assistants.
• Block or quarantine Excel attachments from untrusted senders at the email gateway pending patch confirmation.

Patch Information

Microsoft addressed CVE-2026-78518 through updates distributed via Microsoft Update, Click-to-Run, and Microsoft AutoUpdate for macOS. Consult the Microsoft Security Update Guide for the exact build numbers per channel and validate installed versions with winver or File > Account > About Excel.

Workarounds

• Disable the Outlook Preview Pane and Reading Pane to reduce automatic parsing of untrusted attachments.
• Configure Protected View for files originating from the internet and Outlook attachments, and require explicit user action to exit it.
• Apply Attack Surface Reduction rules that block Office applications from creating child processes and from injecting into other processes.

# Enable ASR rules that limit Office exploitation surface (PowerShell, run as admin)
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

Set-MpPreference -AttackSurfaceReductionRules_Ids `
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View for internet-sourced Office files
New-ItemProperty -Path 'HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView' `
  -Name 'DisableInternetFilesInPV' -Value 0 -PropertyType DWord -Force