CVE-2026-81954: Microsoft 365 Apps Use After Free Vulnerability

CVE-2026-81954 Overview

CVE-2026-81954 is a use-after-free vulnerability [CWE-416] in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw affects multiple versions of Microsoft Office across Windows and macOS, including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC. Exploitation requires user interaction, typically opening a crafted spreadsheet file. Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the current user, which can lead to full compromise of the affected host.

Critical Impact
Attackers can achieve local code execution with high impact to confidentiality, integrity, and availability by convincing a user to open a malicious Excel document.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC
Microsoft 365 and Office 2021/2024 LTSC for macOS

Discovery Timeline

2026-09-08 - CVE-2026-81954 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81954

Vulnerability Analysis

The vulnerability is a use-after-free condition within Microsoft Excel's document parsing and rendering logic. Excel references a memory object after that object has already been freed, allowing an attacker to control the freed region and hijack execution flow. Because the exploited process runs with the privileges of the current user, code execution occurs in that user's security context. The Microsoft advisory notes that user interaction is required, meaning the target must open the malicious file for exploitation to succeed.

Root Cause

Use-after-free flaws [CWE-416] occur when a program continues to use a pointer after the underlying memory has been released. In Excel, this class of bug typically arises from complex object lifetime management across parsing routines, embedded objects, and event handlers. An attacker who can influence the timing and layout of allocations can place attacker-controlled data into the freed slot before it is reused, enabling arbitrary read, write, or control-flow primitives.

Attack Vector

Exploitation requires local file handling with user interaction. An attacker crafts a malicious Excel workbook and delivers it through email, a shared drive, a chat platform, or a compromised website. When the victim opens the file, Excel triggers the use-after-free during parsing or rendering, and the attacker gains code execution in the user's session. No authentication to the target is required.

No public proof-of-concept exploit is available at the time of publication, and CISA has not added CVE-2026-81954 to the Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update Guide for vendor-specific technical details.

Detection Methods for CVE-2026-81954

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Excel processes writing executable content (.exe, .dll, .js, .hta) to user-writable directories like %TEMP%, %APPDATA%, or %LOCALAPPDATA%.
Crash events or Windows Error Reporting entries referencing EXCEL.EXE with access violation exceptions shortly after opening an untrusted workbook.

Detection Strategies

Hunt for Office-to-shell process lineage across the environment and correlate with recent workbook opens from email or web downloads.
Alert on outbound network connections initiated directly by EXCEL.EXE to non-Microsoft destinations.
Inspect inbound .xls, .xlsx, .xlsm, and .xlsb attachments at the mail gateway for anomalies in OLE streams and embedded objects.

Monitoring Recommendations

Enable and centrally collect Microsoft Office telemetry, Sysmon process creation, and image load events for EXCEL.EXE.
Track Mark-of-the-Web (MOTW) propagation on downloaded workbooks and monitor for users bypassing Protected View.
Review endpoint detection alerts for memory corruption exploitation techniques such as ROP chains or shellcode execution within Office processes.

How to Mitigate CVE-2026-81954

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-81954 to all affected Office installations on Windows and macOS.
Prioritize patching for users who routinely handle external spreadsheets, including finance, procurement, and executive assistants.
Instruct users to avoid opening unsolicited Excel attachments and to keep Protected View enabled for files originating from the internet.

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC on both Windows and macOS. Deploy the latest security updates through Microsoft Update, Microsoft Configuration Manager, Intune, or the Microsoft AutoUpdate channel for macOS. Validate patch deployment by confirming the Office build number against the vendor advisory.

Workarounds

Enforce Protected View and Application Guard for Office to isolate untrusted documents until patches are deployed.
Configure Attack Surface Reduction rules that block Office applications from creating child processes and from injecting into other processes.
Block or quarantine spreadsheet attachments from external senders at the mail gateway when business processes allow.

bash

# Example: enable ASR rule blocking Office child processes (PowerShell, run as admin)
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled