CVE-2026-81953: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-81953 Overview

CVE-2026-81953 is a stack-based buffer overflow [CWE-121] in Microsoft Office Excel that allows an attacker to execute arbitrary code locally on a targeted system. Exploitation requires user interaction, typically opening a crafted Excel document. Successful exploitation grants the attacker the privileges of the current user, enabling code execution in the context of the Office process.

The flaw affects multiple supported Office releases across Windows and macOS, including Microsoft 365 Apps, Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC. Microsoft published the advisory on September 8, 2026.

Critical Impact
A crafted spreadsheet can trigger stack memory corruption in Excel and run attacker-controlled code with the privileges of the user opening the file.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Excel 2016, Microsoft Office 2016, Office 2019 (x64 and x86)
Microsoft Office 2021 LTSC and Office 2024 LTSC (Windows and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-81953 published to NVD by Microsoft
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81953

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow in Microsoft Excel's file parsing logic. When Excel processes a specially crafted spreadsheet, a bounded stack buffer receives more data than it can hold, corrupting adjacent stack memory including saved return addresses and structured exception handler records.

Because the flaw is reachable through a document-parsing path, an attacker delivers the exploit as an ordinary Excel file over email, a web download, or a shared drive. Execution occurs entirely on the local host once the target opens the file, without any network authentication.

The issue is classified under [CWE-121: Stack-based Buffer Overflow]. Impact spans confidentiality, integrity, and availability at high levels, and the attacker gains code execution at the privilege level of the invoking user.

Root Cause

The root cause is missing or insufficient bounds validation on a length or count field parsed from an Excel file structure. The parser copies attacker-controlled bytes into a fixed-size stack allocation, allowing the input to overwrite return addresses or exception handler pointers and redirect control flow.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a malicious Excel workbook and social-engineers the victim into opening it. On open, Excel parses the malformed structure, triggers the overflow, and executes attacker-supplied shellcode within the Excel process. No verified public proof-of-concept or in-the-wild exploitation has been reported at publication time.

No verified public exploit code is available. See the Microsoft Security Update Guide for CVE-2026-81953 for vendor technical detail.

Detection Methods for CVE-2026-81953

Indicators of Compromise

Excel process (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Excel crashes or unhandled exceptions logged in Windows Application event log immediately after opening a specific .xls, .xlsx, .xlsm, or .xlsb file.
Outbound network connections initiated by EXCEL.EXE to unfamiliar hosts shortly after document open.
New files written to %APPDATA%, %TEMP%, or user profile Startup folders by the Excel process.

Detection Strategies

Hunt for parent-child process anomalies where Office applications spawn scripting or LOLBin executables.
Alert on module loads or memory allocations flagged as executable in the Excel process after document open.
Correlate inbound email attachments and downloaded spreadsheets with subsequent Excel crashes on the same host.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and executable content.
Forward Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) from endpoints running Office to a SIEM for behavioral analytics.
Track WER (Windows Error Reporting) telemetry for repeated Excel crashes across the fleet as an early indicator of targeting.

How to Mitigate CVE-2026-81953

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-81953 across all Windows and macOS Office installations.
Prioritize patching for users who routinely process externally sourced spreadsheets, such as finance, procurement, and executive assistants.
Verify Microsoft 365 Apps update channels are current and not paused, and confirm click-to-run has completed the update on each endpoint.

Patch Information

Microsoft has released fixes through its September 2026 update cycle. Refer to the vendor advisory for the specific build numbers per channel (Current Channel, Monthly Enterprise, Semi-Annual, and LTSC 2016/2019/2021/2024), and to the macOS installer for Microsoft 365 and Office 2021/2024 LTSC for Mac.

Workarounds

Enable Protected View and Office Protected View for files originating from the internet and email attachments.
Configure Office File Block policy to prevent opening legacy binary Excel formats (.xls, .xlt) from untrusted locations until patching is complete.
Deploy Attack Surface Reduction rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to block Office child process creation.

bash

# Enable ASR rule: Block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Force Microsoft 365 Apps to check for and apply updates
& "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user