CVE-2026-81957: Microsoft 365 Apps RCE Vulnerability

CVE-2026-81957 Overview

CVE-2026-81957 is an out-of-bounds read vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The flaw affects multiple supported Excel and Microsoft 365 Apps builds across Windows and macOS. Exploitation requires user interaction, typically opening a crafted spreadsheet delivered through phishing or shared file channels. Microsoft classifies the weakness under [CWE-125], indicating the parser reads beyond an allocated buffer while processing untrusted file data. Successful exploitation grants code execution in the context of the current user, enabling installation of programs, data theft, or account manipulation depending on user privileges.

Critical Impact

A crafted Excel document processed by a vulnerable Office client can trigger memory disclosure leading to local code execution in the user's security context.

Affected Products

• Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
• Microsoft Excel 2016, Microsoft Office 2016 and Office 2019
• Microsoft Office 2021 LTSC and Office 2024 LTSC (Windows and macOS)

Discovery Timeline

• 2026-09-08 - CVE-2026-81957 published to the National Vulnerability Database
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81957

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the Excel file-parsing logic. When Excel processes a malformed workbook, it reads memory outside the boundaries of an allocated buffer. The read primitive leaks adjacent memory contents and, under attacker-controlled conditions, corrupts program state sufficiently to redirect execution flow. This class of defect frequently arises from missing size checks on record fields inside compound Office file formats.

Exploitation is local and requires user interaction. The attack surface is any workflow where a user opens a spreadsheet, including email attachments, shared drives, and web downloads. Because code executes with the invoking user's privileges, the impact scales with the account context. Standard users grant application-level access, while administrative accounts expose the full system.

Root Cause

The root cause is insufficient validation of length or index fields inside an Excel file structure. The parser trusts attacker-controlled offsets and reads past the end of an in-memory buffer. The classification [CWE-125] confirms an out-of-bounds read primitive.

Attack Vector

An attacker crafts a malicious .xls, .xlsx, or related Office document containing manipulated internal records. The attacker delivers the file to a target through phishing, collaboration platforms, or file-sharing services. When the victim opens the document in a vulnerable Excel build, the parser processes the malformed structure, triggering the out-of-bounds read and enabling code execution in the user's session.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Microsoft Vulnerability Advisory CVE-2026-81957 for authoritative technical details.

Detection Methods for CVE-2026-81957

Indicators of Compromise

• Excel or Microsoft 365 client processes (EXCEL.EXE) crashing or spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
• Unusual outbound network connections initiated by Office processes shortly after a document is opened.
• Writes to persistence locations (Run keys, Startup folder, Scheduled Tasks) by Office child processes.

Detection Strategies

• Hunt for parent-child process anomalies where Excel launches scripting engines or LOLBins.
• Inspect Office telemetry for Watson crash reports referencing Excel modules following the opening of external documents.
• Correlate email gateway or download proxy events delivering spreadsheet attachments with subsequent endpoint activity from EXCEL.EXE.

Monitoring Recommendations

• Enable Microsoft Office cloud protection and Attack Surface Reduction (ASR) rules that block child process creation from Office applications.
• Forward endpoint process telemetry and Office logs to a centralized data lake for retrospective hunting.
• Track patch deployment coverage across all affected Office SKUs to identify unpatched hosts.

How to Mitigate CVE-2026-81957

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Vulnerability Advisory CVE-2026-81957 to all affected Office and Microsoft 365 Apps installations.
• Prioritize patching for users who routinely handle external spreadsheets, including finance, HR, and executive assistants.
• Verify Microsoft 365 Apps update channels are current on both Windows and macOS endpoints.

Patch Information

Microsoft has released updates addressing CVE-2026-81957 across Microsoft 365 Apps, Excel 2016, Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC on Windows and macOS. Refer to the vendor advisory for build numbers specific to each channel and platform.

Workarounds

• Enable Protected View and Office Application Guard to open documents from untrusted sources in an isolated container.
• Block macro execution from files originating on the internet using Group Policy.
• Configure ASR rules to prevent Office applications from creating child processes or injecting into other processes.

# Configuration example: enable ASR rule to block Office child process creation
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled