CVE-2026-81947: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-81947 Overview

CVE-2026-81947 is a heap-based buffer overflow [CWE-122] in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw affects a broad range of Microsoft Office deployments, including Microsoft 365 Apps, Excel 2016, Office 2016 through Office 2024, and Office Online Server. Exploitation requires the target user to open a crafted spreadsheet, after which the attacker gains code execution in the context of the user.

Critical Impact
A crafted Excel document can trigger a heap overflow that yields arbitrary code execution on the victim workstation, enabling initial access, credential theft, or lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Excel 2016, Office 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2026-09-08 - CVE-2026-81947 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81947

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow inside Microsoft Excel's parsing logic. When Excel processes a malformed spreadsheet, it writes beyond the bounds of a heap-allocated buffer. The out-of-bounds write corrupts adjacent heap metadata or object pointers used later by the application.

An attacker who controls the overflowing bytes can influence control-flow structures such as virtual function tables or function pointers. Successful exploitation results in arbitrary code execution under the identity of the user who opened the document. Because Office often runs with the interactive user's privileges, the attacker inherits access to local files, cached credentials, and reachable network resources.

Root Cause

The root cause is improper validation of size or length values during deserialization of Excel file structures. Excel allocates a heap buffer based on one field and then copies data using a separate, attacker-controlled length. The mismatch produces a classic [CWE-122] heap overflow. Microsoft has not published the specific parser component in the public advisory.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a weaponized .xls, .xlsx, .xlsm, or related Excel file through phishing email, a compromised website, a shared drive, or an instant-messaging channel. When the victim opens the file, or in some cases previews it in the Windows Explorer preview pane, the vulnerable parser executes the attacker's payload. Authentication is not required, and no elevated privileges are needed on the target host.

No public proof-of-concept exploit or in-the-wild exploitation has been reported. Refer to the Microsoft Security Update Guide for the authoritative technical bulletin.

Detection Methods for CVE-2026-81947

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, particularly cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel writing executable content, DLLs, or scripts to %TEMP%, %APPDATA%, or Public user folders.
Outbound network connections initiated by EXCEL.EXE to newly observed or low-reputation domains shortly after document open.
Crash or Windows Error Reporting events referencing heap corruption in Excel modules.

Detection Strategies

Hunt for process-lineage anomalies where EXCEL.EXE is the parent of scripting or LOLBin processes.
Inspect inbound email attachments and shared documents for Excel files containing malformed BIFF or OOXML records.
Correlate document-open events with subsequent file writes and network beacons to surface exploitation chains.

Monitoring Recommendations

Enable and forward Microsoft Office telemetry, Sysmon process and file events, and PowerShell script-block logging to a centralized analytics platform.
Monitor Windows Error Reporting and application crash events for repeated Excel faults, which may indicate exploitation attempts.
Track use of Office macros, ActiveX, and embedded OLE objects across the fleet to reduce attack surface.

How to Mitigate CVE-2026-81947

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide across all Office channels, including Current Channel, Monthly Enterprise Channel, and LTSC builds.
Prioritize patching for users who routinely handle external spreadsheets, such as finance, procurement, and executive assistants.
Block or quarantine inbound Excel attachments from untrusted senders at the mail gateway until patches are deployed.

Patch Information

Microsoft has released fixed builds for Microsoft 365 Apps, Excel 2016, Office 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Office for Mac, and Office Online Server. Consult the vendor advisory for exact build numbers per channel and platform, and validate deployment using Microsoft Update, Intune, WSUS, or Configuration Manager.

Workarounds

Enable Protected View and Application Guard for Office to sandbox documents originating from the internet or email.
Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from injecting into other processes.
Set Office File Block policy to prevent opening legacy Excel binary formats from untrusted locations, or force them to open in Protected View only.
Educate users to avoid opening unsolicited spreadsheets and to report suspicious documents to the security team.

bash

# Example: enable ASR rule to block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled