CVE-2026-81397: Microsoft 365 Apps Buffer Overflow

CVE-2026-81397 Overview

CVE-2026-81397 is a heap-based buffer overflow [CWE-122] in Microsoft Office Excel that allows an unauthenticated attacker to execute code locally on a victim system. Exploitation requires user interaction, typically opening a crafted Excel document. Successful exploitation grants the attacker code execution in the context of the current user, compromising confidentiality, integrity, and availability. The vulnerability affects multiple Microsoft Office product lines including Microsoft 365 Apps, Office 2016, 2019, 2021, and 2024 on Windows and macOS platforms.

Critical Impact
A single crafted .xlsx or .xls file can trigger heap corruption in Excel and lead to arbitrary code execution under the current user account.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016, Microsoft Office 2016, 2019, 2021 (LTSC), and Office 2024 (LTSC)
Microsoft 365 and Office 2021/2024 LTSC for macOS

Discovery Timeline

2026-09-08 - CVE-2026-81397 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81397

Vulnerability Analysis

The flaw is a heap-based buffer overflow inside Microsoft Excel's document parsing logic. When Excel processes a maliciously crafted spreadsheet, it writes data past the bounds of a heap-allocated buffer. The overflow corrupts adjacent heap metadata or object pointers, allowing an attacker to influence program flow. Because Excel runs in the interactive user's session, code executes with the same privileges as the logged-in user.

The attack requires local access in the sense that the file is opened on the target host, but delivery is typically achieved through email attachments, cloud storage links, or shared network paths. User interaction is required: the victim must open the crafted workbook. No prior authentication to Excel or the operating system is needed beyond a normal user session.

Root Cause

The underlying weakness is classified as [CWE-122] Heap-based Buffer Overflow. Excel's parser fails to validate the length of a structure inside the workbook file against the size of the destination heap buffer, resulting in out-of-bounds writes during deserialization of the malicious content.

Attack Vector

An attacker crafts an Excel file containing malformed data that triggers the overflow during parsing. The file is delivered by phishing, watering-hole download, or shared collaboration platform. When the user opens the workbook, Excel processes the malicious structure, corrupts the heap, and the attacker gains arbitrary code execution. Protected View may mitigate execution if the file originates from the internet and the user does not enable editing.

No public proof-of-concept or in-the-wild exploitation has been reported. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-81397

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, wscript.exe, rundll32.exe, or regsvr32.exe.
Excel crashes or Windows Error Reporting entries referencing heap corruption faults in Excel.exe or associated parsing modules.
Suspicious .xlsx, .xlsm, .xls, or .xlsb files delivered via email or downloaded from untrusted sources immediately preceding anomalous activity.
Outbound network connections initiated by Excel to non-Microsoft destinations shortly after a document is opened.

Detection Strategies

Hunt for process lineage where EXCEL.EXE is the parent of scripting or LOLBin processes across endpoint telemetry.
Correlate Office application crash telemetry with the recent opening of externally sourced documents.
Apply file inspection rules at the mail gateway that flag Excel documents containing malformed BIFF or OOXML structures.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes.
Forward Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) from workstations into a centralized data lake for long-term hunting.
Track patch deployment status for the Office product family and alert on hosts that remain on vulnerable builds.

How to Mitigate CVE-2026-81397

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide across all Windows and macOS Office installations.
Prioritize patching endpoints belonging to users who routinely receive external Excel attachments, such as finance, procurement, and executive assistants.
Verify Microsoft 365 Apps update channels are configured to receive current builds and confirm client-side installation.

Patch Information

Microsoft has released fixes through the standard Office and Microsoft 365 update channels. Consult the Microsoft Security Update Guide for the specific build numbers that remediate the heap-based buffer overflow across Microsoft 365 Apps, Excel 2016, Office 2016, 2019, 2021 LTSC, and Office 2024 LTSC on both Windows and macOS.

Workarounds

Enforce Protected View and Block Macros from the Internet through Group Policy to reduce exposure from untrusted files.
Enable the ASR rule that blocks Office applications from creating child processes to disrupt post-exploitation activity.
Restrict Excel file types at the email gateway or route them through a sandboxed detonation service prior to delivery.

bash

# Enable ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View for files originating from the Internet (per-user registry)
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f