CVE-2026-81956: Microsoft 365 Apps RCE Vulnerability

CVE-2026-81956 Overview

CVE-2026-81956 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw affects multiple Microsoft Office product lines including Microsoft 365 Apps, Office 2016, Office 2019, Office 2021, Office 2024, and Office Online Server. Exploitation requires the target user to open a crafted Excel file, after which code executes in the user's security context. Microsoft published the advisory on September 8, 2026.

Critical Impact
A crafted Excel document can trigger an out-of-bounds read that leads to local code execution with the current user's privileges, compromising confidentiality, integrity, and availability of the affected host.

Affected Products

Microsoft 365 Apps (x64 and x86 enterprise editions) and Microsoft 365 for macOS
Microsoft Excel 2016, Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS where applicable)
Microsoft Office Online Server

Discovery Timeline

2026-09-08 - CVE-2026-81956 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81956

Vulnerability Analysis

The vulnerability is an out-of-bounds read within Microsoft Excel's file parsing logic. When Excel processes a specially crafted spreadsheet, it reads memory beyond the bounds of an allocated buffer. Attackers can leverage the read primitive to leak process memory and, in combination with structured file content, achieve arbitrary code execution in the context of the user opening the file.

Because the attack vector is local and requires user interaction, exploitation typically relies on delivering a malicious .xls, .xlsx, or related spreadsheet through phishing, shared drives, or drive-by download. Successful exploitation grants the attacker the same privileges as the logged-on user, enabling persistence, credential theft, or lateral movement.

Root Cause

The root cause is missing or insufficient bounds checking during parsing of structured spreadsheet content. Excel dereferences memory outside the intended buffer boundary, which corresponds to the classification [CWE-125] Out-of-bounds Read. The condition can be steered by attacker-controlled field lengths or offsets embedded in the crafted document.

Attack Vector

Exploitation follows a client-side file-open pattern. The attacker crafts a malicious workbook and delivers it to the target through email, collaboration platforms, or web download. When the user opens the file in a vulnerable version of Excel, the parser triggers the out-of-bounds read and executes attacker-supplied code. No network authentication or elevated privileges are required beyond the interactive user session.

Refer to the Microsoft CVE-2026-81956 Advisory for build-specific details.

Detection Methods for CVE-2026-81956

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, rundll32.exe, mshta.exe, or wscript.exe.
Excel processes writing executable content or scripts to %TEMP%, %APPDATA%, or %PUBLIC% directories.
Inbound spreadsheet attachments with anomalous embedded objects, macros, or malformed BIFF/OOXML structures.
Crash events or Windows Error Reporting entries referencing EXCEL.EXE faulting modules shortly after document open.

Detection Strategies

Monitor Microsoft Office child-process telemetry and alert on non-standard descendants of EXCEL.EXE.
Correlate document-open events with subsequent outbound network connections to newly observed domains.
Deploy YARA rules targeting known malformed Excel structures used to trigger out-of-bounds parsing.
Enable Attack Surface Reduction (ASR) rules for Office and audit the resulting telemetry.

Monitoring Recommendations

Ingest Microsoft Defender, Sysmon, and EDR telemetry into a centralized SIEM for cross-host correlation.
Track patch level of Office builds across the fleet and alert on hosts still running vulnerable versions.
Monitor email gateway logs for spreadsheets sourced from external senders with suspicious metadata.

How to Mitigate CVE-2026-81956

Immediate Actions Required

Apply the security updates referenced in the Microsoft CVE-2026-81956 Advisory across all affected Office channels.
Prioritize patching for users who regularly receive external spreadsheets, including finance, procurement, and executive assistants.
Verify Office Online Server deployments are updated, since server-side rendering can be exposed to attacker-supplied files.

Patch Information

Microsoft has released security updates addressing CVE-2026-81956 for Microsoft 365 Apps, Excel 2016, Office 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Office Online Server. Consult the vendor advisory for exact build numbers per channel and platform (Windows and macOS).

Workarounds

Enable Protected View and Office Protected Mode for files originating from the internet or email attachments.
Block or quarantine spreadsheet attachments from untrusted senders at the email gateway.
Enforce Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes.
Restrict opening of legacy Excel binary formats (.xls, .xlsb) where not required by business processes.

bash

# Enable ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Verify Protected View settings via registry (per Office version, example for 16.0)
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f