CVE-2026-81951: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-81951 Overview

CVE-2026-81951 is a heap-based buffer overflow [CWE-122] in Microsoft Office Excel that permits local code execution. An attacker crafts a malicious spreadsheet and delivers it to a target user. When the user opens the file, Excel mishandles memory during parsing and corrupts the heap. Successful exploitation runs arbitrary code in the context of the current user.

The flaw affects Microsoft 365 Apps, Excel 2016, and Office 2016, 2019, 2021, and 2024 across Windows and macOS platforms. Microsoft published the advisory on September 8, 2026.

Critical Impact
Opening a weaponized Excel document grants an attacker code execution with the victim's privileges, enabling malware installation, credential theft, and lateral movement.

Affected Products

Microsoft 365 Apps (x64, x86) and Microsoft 365 for macOS
Microsoft Excel 2016, Office 2016, Office 2019 (x64, x86)
Microsoft Office 2021 LTSC and Office 2024 LTSC (Windows and macOS)

Discovery Timeline

2026-09-08 - Microsoft publishes security advisory for CVE-2026-81951
2026-09-08 - CVE-2026-81951 published to the National Vulnerability Database
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-81951

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Excel's document parsing logic. Excel writes attacker-controlled data past the bounds of a heap-allocated buffer while processing a crafted spreadsheet. The overflow corrupts adjacent heap metadata or object pointers, giving an attacker control over program execution.

Exploitation requires local user interaction. The victim must open a malicious .xlsx, .xls, or related Office file received through email, a file share, or a web download. No network authentication is required from the attacker.

Code executes at the privilege level of the Excel process, typically the interactive user. On systems where users hold administrative rights, the attacker gains full control of the host. Confidentiality, integrity, and availability are all impacted.

Root Cause

The underlying defect is improper bounds checking on a heap allocation during Excel file parsing. When the file contains a structure with an oversized or malformed length field, Excel allocates a buffer based on incorrect size assumptions and then writes beyond the allocation. This class of defect is tracked as CWE-122: Heap-based Buffer Overflow.

Attack Vector

Attackers typically weaponize this class of flaw through phishing campaigns. A crafted spreadsheet is delivered as an attachment or hosted on an attacker-controlled site. Preview panes in email clients and file explorers can also trigger parsing in some scenarios. Once the document loads, shellcode staged inside the file runs with the user's rights.

Refer to the Microsoft Security Update Guide for CVE-2026-81951 for vendor-supplied technical detail.

Detection Methods for CVE-2026-81951

Indicators of Compromise

Unexpected EXCEL.EXE child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel crashes with faulting module entries referencing heap corruption in the Windows Event Log or macOS crash reports.
Newly written executables, DLLs, or scripts in user-writable paths shortly after opening an Excel document.
Outbound network connections from EXCEL.EXE to previously unseen domains or IP addresses.

Detection Strategies

Hunt for process ancestry where Excel spawns interpreters or LOLBins outside normal macro workflows.
Alert on Office applications loading unsigned or unusual DLLs from %APPDATA% or %TEMP%.
Correlate email attachment delivery of spreadsheet files with subsequent suspicious process activity on the recipient host.
Inspect Office documents in transit for malformed BIFF or OOXML structures that exceed expected size fields.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office child processes and executable content creation.
Forward Sysmon process, image load, and network events to a central analytics platform for retrospective hunting.
Track Office application crash telemetry to identify potential exploitation attempts, including failed ones.

How to Mitigate CVE-2026-81951

Immediate Actions Required

Apply the September 2026 Microsoft security updates to all affected Office and Microsoft 365 Apps installations.
Prioritize patching for users who routinely handle external spreadsheets, including finance, procurement, and executive assistants.
Verify update deployment via Microsoft Endpoint Manager, WSUS, or your patch management platform.

Patch Information

Microsoft has released fixes referenced in the Microsoft Security Update Guide for CVE-2026-81951. Deploy the updates for each affected channel: Microsoft 365 Apps (Current, Monthly Enterprise, Semi-Annual), Office LTSC 2021 and 2024, Office 2019, and Office 2016. macOS builds of Microsoft 365 and Office LTSC receive separate updates through AutoUpdate.

Workarounds

Enable Protected View for files originating from the internet and other untrusted locations.
Block or quarantine Office attachments at the email gateway from external senders when patching is delayed.
Configure the File Block policy to prevent opening legacy Excel binary formats from untrusted zones.
Restrict end users from running with local administrator rights to limit post-exploitation impact.

bash

# Enable Protected View for files from the internet via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f