CVE-2026-81960: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-81960 Overview

CVE-2026-81960 is a heap-based buffer overflow [CWE-122] in Microsoft Office Excel that enables local code execution. An attacker crafts a malicious spreadsheet and delivers it to a target user through email, shared storage, or a web download. When the user opens the file, Excel mishandles memory allocation on the heap, allowing attacker-controlled data to overwrite adjacent structures. Successful exploitation results in arbitrary code execution in the context of the current user. The flaw affects Microsoft 365 Apps, Microsoft Excel 2016, Office 2016 through 2024, and Microsoft 365 on macOS. Microsoft published the advisory on September 8, 2026.

Critical Impact
Successful exploitation grants attacker-controlled code execution with the privileges of the user opening the crafted Excel document, enabling persistence, credential theft, and lateral movement.

Affected Products

Microsoft 365 Apps (x64 and x86, Enterprise) and Microsoft 365 for macOS
Microsoft Excel 2016, Office 2016, Office 2019 (x64 and x86)
Office LTSC 2021 and Office LTSC 2024 (x64, x86, and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-81960 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81960

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in Microsoft Office Excel's file parsing logic. Excel allocates a fixed-size heap buffer based on a length or count field read from the input document. When the parser copies attacker-controlled data into that buffer without validating the destination size, it writes past the allocated region. The overflow corrupts adjacent heap metadata or object pointers, allowing an attacker to redirect execution flow.

Exploitation requires user interaction. The victim must open the malicious spreadsheet in a vulnerable Excel client. Because Excel runs in the current user's security context, successful exploitation yields code execution at that privilege level. Attackers commonly chain this class of bug with phishing lures that reference invoices, payroll, or shared reports.

At time of publication no public proof-of-concept exists, no exploit is listed in Exploit-DB, and CISA has not added the CVE to the Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is insufficient bounds checking on a length or offset field parsed from an Excel document structure. The parser trusts an untrusted size value and copies content into an undersized heap allocation, producing an out-of-bounds write on the heap.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted .xls, .xlsx, or related Excel file through email attachment, cloud share link, USB media, or a drive-by download. When the target user opens the file with a vulnerable Excel build, parsing triggers the heap overflow. Protected View may mitigate execution for files marked with the Mark-of-the-Web, but users who click "Enable Editing" defeat that mitigation.

No verified proof-of-concept is available. See the Microsoft advisory for technical details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81960

Detection Methods for CVE-2026-81960

Indicators of Compromise

Unexpected child processes of EXCEL.EXE such as cmd.exe, powershell.exe, wscript.exe, rundll32.exe, or mshta.exe.
Excel spawning outbound network connections to unfamiliar domains or IPs shortly after a document is opened.
Creation of executable files, scripts, or scheduled tasks in user-writable directories following Excel activity.
Crash events (Application Error, Event ID 1000) referencing EXCEL.EXE with heap corruption exception codes such as 0xC0000374.

Detection Strategies

Monitor process lineage for Office applications and alert on any Excel-initiated process that executes scripting engines or LOLBins.
Inspect Excel-opened files for structural anomalies including malformed BIFF records, oversized stream lengths, or unusual embedded objects.
Correlate Mark-of-the-Web bypass attempts with subsequent process execution from the Office suite.

Monitoring Recommendations

Ingest Sysmon Event IDs 1, 3, 7, and 11 filtered on EXCEL.EXE to build a baseline of legitimate behavior.
Track email gateway telemetry for spreadsheet attachments from external senders, especially those with macros or embedded OLE objects.
Enable Microsoft Defender for Office 365 Safe Attachments detonation and forward verdicts to the SIEM for correlation.

How to Mitigate CVE-2026-81960

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Response Center advisory for CVE-2026-81960 across all Windows and macOS Office deployments.
Confirm Microsoft 365 Apps update channels are current and force update rings for stalled clients.
Block inbound Excel attachments from untrusted external senders at the mail gateway until patching completes.
Enforce Protected View and Mark-of-the-Web for documents originating from the internet or email.

Patch Information

Microsoft published the patch guidance in its Security Update Guide entry for CVE-2026-81960. Administrators should review the MSRC advisory for the specific build numbers required for Microsoft 365 Apps, Excel 2016, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 for macOS. Deploy through Microsoft Update, Configuration Manager, Intune, or the Office CDN update channel.

Workarounds

Enable Attack Surface Reduction (ASR) rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to block Office applications from creating child processes.
Configure Group Policy to open files from the internet in Protected View and disable macros for files from untrusted locations.
Restrict opening of legacy Excel binary formats (.xls, .xlsb) using File Block Settings in the Trust Center where operationally feasible.

bash

# Enable ASR rule to block Office apps from creating child processes (PowerShell, run as admin)
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View for internet-origin files via registry
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f