CVE-2026-81950 Overview
CVE-2026-81950 is a double free vulnerability [CWE-415] in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw affects multiple supported Office releases, including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021, and Office 2024 across Windows and macOS platforms. Exploitation requires user interaction, typically opening a crafted spreadsheet, but requires no prior authentication. Successful exploitation yields code execution in the context of the current user, with impact to confidentiality, integrity, and availability. Microsoft published the advisory on September 8, 2026.
Critical Impact
A crafted Excel document can trigger a double free during parsing, allowing arbitrary code execution in the user's security context on Windows and macOS endpoints.
Affected Products
- Microsoft 365 Apps (Enterprise, x86 and x64)
- Microsoft Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC
- Microsoft 365 and Office 2021/2024 LTSC for macOS
Discovery Timeline
- 2026-09-08 - CVE-2026-81950 published to NVD and Microsoft security advisory released
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-81950
Vulnerability Analysis
The vulnerability is a double free [CWE-415] in the Excel document parsing logic. When Excel processes a specially crafted workbook, an internal heap allocation is released twice through mismatched cleanup paths. The second free corrupts the heap allocator's metadata, giving an attacker control over subsequent allocations. An attacker with control of the freelist can steer future writes to arbitrary memory and hijack execution flow. Because Office runs with the invoking user's privileges, code execution inherits those permissions.
Root Cause
The defect stems from improper lifetime management of a heap object during Excel file parsing. A cleanup routine releases memory that another code path has already freed, without clearing or invalidating the underlying pointer. Double free conditions in C/C++ code frequently arise from error-handling branches that assume ownership transfer occurred when it did not.
Attack Vector
The attack vector is Local with required user interaction. An attacker delivers a malicious .xlsx, .xls, or .xlsm file through email, a shared drive, or a web download. When the victim opens the document in a vulnerable Excel build, the parser triggers the double free. No authentication is required on the target. Protected View reduces but does not eliminate exposure, since users routinely enable editing on documents received from apparently trusted sources.
No public proof-of-concept exploit code has been published for CVE-2026-81950. See the Microsoft Security Update CVE-2026-81950 advisory for technical details.
Detection Methods for CVE-2026-81950
Indicators of Compromise
- Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
- Excel process crashes with heap corruption exceptions (STATUS_HEAP_CORRUPTION, 0xC0000374) recorded in Windows Error Reporting.
- Outbound network connections from EXCEL.EXE to unfamiliar hosts shortly after a document is opened.
- Unsigned DLLs loaded into the Excel process from user-writable directories such as %APPDATA% or %TEMP%.
Detection Strategies
- Hunt for Office applications launching scripting or LOLBin utilities, correlating parent-child process relationships across the fleet.
- Alert on Excel process crashes with heap-related exception codes, which can indicate exploitation attempts or unstable exploits.
- Inspect inbound email and file-share traffic for spreadsheets containing malformed or obfuscated structures known to trigger parser flaws.
Monitoring Recommendations
- Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and writing executable content.
- Forward Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) from endpoints running Office to a centralized SIEM for behavioral analytics.
- Track Office version telemetry across the environment to identify unpatched hosts and prioritize remediation.
How to Mitigate CVE-2026-81950
Immediate Actions Required
- Apply the September 2026 Microsoft security updates referenced in the Microsoft Security Update CVE-2026-81950 advisory to all affected Office builds.
- Confirm Microsoft 365 Apps clients are receiving updates from the Current or Monthly Enterprise Channel and have restarted to complete installation.
- Restrict opening of Excel attachments from external senders at the mail gateway until patch coverage is verified.
Patch Information
Microsoft has released updates addressing CVE-2026-81950 for Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC on both Windows and macOS. Refer to the Microsoft Security Update CVE-2026-81950 advisory for the exact build numbers per channel and platform. Verify installation using File > Account > About Excel or by querying the installed product version through management tooling.
Workarounds
- Enforce Protected View for files originating from the internet and other untrusted locations through Group Policy.
- Block macro execution in files from the internet using the Block macros from running in Office files from the Internet policy.
- Use Attack Surface Reduction rules to prevent Office applications from creating child processes and injecting into other processes.
- Deliver security awareness reminders instructing users not to enable editing on unexpected spreadsheets.
# Enable ASR rule: Block all Office applications from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
-AttackSurfaceReductionRules_Actions Enabled
# Verify enforcement
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
