CVE-2026-81389: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-81389 Overview

CVE-2026-81389 is a heap-based buffer overflow vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute arbitrary code locally. The flaw is classified under [CWE-122] (Heap-based Buffer Overflow) and affects multiple supported Office releases across Windows and macOS. Exploitation requires a user to open a crafted Excel document, delivering code execution in the context of the current user. Microsoft published the advisory on 2026-09-08, and the entry was last updated on 2026-09-09.

Critical Impact
A successful exploit lets an attacker run code with the privileges of the Excel user, enabling malware installation, data theft, or lateral movement from a single crafted spreadsheet.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Excel 2016, Microsoft Office 2016 and Office 2019 (x64 and x86)
Microsoft Office LTSC 2021 and Office LTSC 2024 (Windows x64/x86 and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-81389 published to the National Vulnerability Database
2026-09-08 - Microsoft advisory released for CVE-2026-81389
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81389

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow inside Microsoft Excel's parsing routines for spreadsheet content. When Excel processes a malformed structure in a crafted workbook, the code writes beyond the bounds of a heap-allocated buffer. Attackers can shape the overflow to corrupt adjacent heap metadata or object pointers used later by the application. That corruption can be steered into control-flow hijacking, leading to arbitrary code execution in the Excel process.

Exploitation is local and requires user interaction, since the victim must open the attacker-supplied file. Attack complexity is high, reflecting the need to shape the heap and bypass mitigations such as ASLR and DEP. The impact on confidentiality, integrity, and availability is high because code runs with the user's privileges.

Root Cause

The root cause is insufficient validation of length or size fields during deserialization of Excel document structures. Excel allocates a fixed-size heap buffer based on assumed input constraints, then copies attacker-controlled data into it without verifying the destination bounds, producing the overflow described in [CWE-122].

Attack Vector

The attack vector is local file delivery. An attacker crafts a malicious .xlsx, .xlsm, or legacy .xls file and delivers it through email, chat, a shared drive, or a web download. When the victim opens the document in a vulnerable Excel version, the parsing routine triggers the overflow and executes attacker-controlled code. Preview Pane rendering is a common secondary trigger for Office memory corruption flaws and should be assumed relevant until Microsoft's advisory states otherwise. Refer to the Microsoft CVE-2026-81389 Advisory for authoritative technical details.

Detection Methods for CVE-2026-81389

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel writing executable content (.exe, .dll, .js, .hta, .ps1) into user-writable paths such as %APPDATA%, %TEMP%, or %PUBLIC%.
Excel processes making outbound network connections to newly observed or low-reputation domains shortly after a document is opened.
Crashes of EXCEL.EXE with access violation records in Windows Error Reporting followed by anomalous process activity on the same host.

Detection Strategies

Hunt for parent-child process relationships where EXCEL.EXE launches a scripting or LOLBin binary, then correlate with file creation and network events on the same host.
Alert on Office applications loading unsigned or unusual DLLs from user-writable directories, which frequently indicates post-exploitation payload staging.
Inspect inbound Excel attachments at the mail gateway for anomalous embedded objects, oversized records, or malformed BIFF/OOXML structures.

Monitoring Recommendations

Enable and forward Microsoft Defender, EDR, and Sysmon telemetry (Event IDs 1, 3, 7, 11) for Office processes into a centralized analytics platform.
Monitor patch compliance for Microsoft 365 Apps, Excel 2016, Office 2016/2019, and Office LTSC 2021/2024 across Windows and macOS endpoints.
Track Windows Error Reporting and crash dumps for repeated EXCEL.EXE faults, which can indicate exploitation attempts or unstable exploit chains.

How to Mitigate CVE-2026-81389

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-81389 Advisory to all affected Office and Microsoft 365 installations.
Prioritize patching endpoints used by finance, executive, and administrative staff, who are common targets for weaponized spreadsheets.
Block or quarantine inbound Excel files from untrusted external senders at the mail and web gateways until patches are deployed.

Patch Information

Microsoft has released fixes for the affected products through its standard update channels. Consult the Microsoft CVE-2026-81389 Advisory for build numbers and update package identifiers covering Microsoft 365 Apps, Excel 2016, Office 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024 on Windows and macOS. Verify deployment through Microsoft Endpoint Configuration Manager, Intune, or the applicable macOS update mechanism.

Workarounds

Enable Protected View and Office Application Guard so untrusted Excel files render in an isolated container instead of the host process.
Disable the Outlook Preview Pane and Windows Explorer preview handlers for Office file types to reduce accidental parsing.
Apply Attack Surface Reduction rules that block Office applications from creating child processes and from writing executable content.
Restrict macro execution to signed macros only and enforce Mark-of-the-Web handling for files sourced from the internet.

bash

# Example: enforce ASR rule blocking Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled