CVE-2026-88145: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-88145 Overview

CVE-2026-88145 is a heap-based buffer overflow vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute arbitrary code over a network. The flaw affects Microsoft 365 Apps, Microsoft 365, Office LTSC 2021, and Office LTSC 2024 across Windows and macOS platforms. Successful exploitation requires a user to open a crafted spreadsheet, giving attackers code execution in the context of the current user. The weakness is classified under [CWE-122: Heap-based Buffer Overflow]. Microsoft has published guidance through the Microsoft Security Response Center.

Critical Impact
Remote attackers can achieve arbitrary code execution on vulnerable systems when a user opens a malicious Excel document, enabling full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office LTSC 2021 (Windows x64/x86 and macOS)
Microsoft Office LTSC 2024 (Windows x64/x86 and macOS)

Discovery Timeline

2026-10-13 - CVE-2026-88145 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-88145

Vulnerability Analysis

The vulnerability resides in Microsoft Excel's parsing of spreadsheet file structures. When Excel processes malformed data within a crafted workbook, it writes beyond the bounds of a heap-allocated buffer. This out-of-bounds write corrupts adjacent heap metadata or object pointers used by the application. An attacker who controls the overflowed data can steer execution into attacker-supplied code or ROP chains.

Exploitation requires user interaction. The target must open a weaponized .xlsx, .xls, or related Office file delivered through email, chat, cloud sharing, or a web download. No prior authentication or privileges on the victim machine are needed. Code executes with the privileges of the logged-in user, which is sufficient to deploy additional payloads, steal credentials, or move laterally.

Root Cause

The root cause is improper validation of size or boundary conditions during the parsing of embedded spreadsheet structures, mapped to [CWE-122]. Excel allocates a buffer on the heap based on untrusted length fields and then copies attacker-controlled content without enforcing the allocation size. The resulting heap corruption is deterministic enough to support reliable remote code execution.

Attack Vector

The attack vector is network-based delivery of a malicious Office document. Typical delivery methods include phishing emails with attachments, links to SharePoint or OneDrive files, and drive-by downloads. The Preview Pane may increase risk by rendering file contents without a full open action. Once execution lands in Excel, attackers commonly chain to living-off-the-land binaries such as powershell.exe, rundll32.exe, or mshta.exe for post-exploitation.

No public proof-of-concept exploit code is listed for CVE-2026-88145 at the time of writing. Technical details are described in the Microsoft Security Update Guide CVE-2026-88145.

Detection Methods for CVE-2026-88145

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, particularly cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, or mshta.exe.
Office applications writing executable files or scripts to %TEMP%, %APPDATA%, or %PROGRAMDATA% directories.
Outbound network connections initiated by EXCEL.EXE to untrusted hosts shortly after a document is opened.
Crash events for EXCEL.EXE referencing heap corruption or access violations in Office parsing modules.

Detection Strategies

Hunt for process-tree anomalies where Office applications are the parent of command interpreters or script engines.
Inspect email gateways for Excel attachments containing anomalous binary structures or embedded OLE objects.
Correlate Microsoft Defender ASR rule triggers for Office child-process creation with endpoint telemetry.
Use MITRE ATT&CK mapping for T1203 (Exploitation for Client Execution) and T1566.001 (Spearphishing Attachment).

Monitoring Recommendations

Enable and forward Sysmon Event IDs 1, 3, and 11 from endpoints running Excel to a central SIEM.
Monitor Windows Error Reporting and Application crash events naming EXCEL.EXE as the faulting process.
Alert on new persistence artifacts (Run keys, Scheduled Tasks, WMI subscriptions) created within minutes of an Office process launch.

How to Mitigate CVE-2026-88145

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Office installations.
Prioritize patching endpoints used by high-risk users such as finance, executive, and IT administrator roles.
Instruct users to avoid opening Excel attachments from untrusted senders until patches are deployed.
Block or quarantine inbound Excel files from external senders at the email gateway during the patch window.

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024. Administrators should deploy updates through Microsoft Update, Microsoft 365 Apps admin center, Intune, or Microsoft Configuration Manager. Confirm patch application by verifying the Office build number against the version listed in Microsoft's advisory.

Workarounds

Enable Protected View for files originating from the Internet and other untrusted locations.
Configure Microsoft Defender Attack Surface Reduction rules to block Office applications from creating child processes.
Disable the Outlook Preview Pane for message classes that render Excel content inline.
Enforce Mark-of-the-Web propagation so downloaded Excel files open in Protected View by default.

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View for files from the internet
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f