Excel Memory Corruption Bug Enables Remote Code Execution on Windows and Mac
A high-severity memory corruption bug in Microsoft Excel allows remote attackers to run arbitrary code on affected systems without prior authentication.
Key points
- Microsoft rates CVE-2026-100212 as a high-severity remote code execution flaw in Excel.
- The vulnerability affects Microsoft 365, Office LTSC 2021, and Office LTSC 2024 across Windows and Mac.
- Attackers can exploit the issue over a network by sending a specially crafted file to a user.
Microsoft Excel contains a memory corruption flaw that permits remote attackers to execute code on a victim’s machine. The issue stems from a use-after-free error, a common class of software bug where a program continues to use memory after it has been freed. This allows an unauthorised attacker to manipulate the application’s memory state and inject malicious instructions.
Root cause
The underlying technical fault is identified as a use-after-free vulnerability, classified under CWE-416. In software development, this occurs when a pointer references memory that has already been released back to the system. If the application writes to this freed memory, it can corrupt adjacent data structures. Microsoft’s security advisory confirms that this specific flaw in Excel enables an unauthorised attacker to execute code over a network. The National Vulnerability Database assigns a CVSS score of 8.8, categorising the severity as high.
Attack path
An attacker does not need local access or prior authentication to exploit this weakness. According to the official advisory, the flaw allows an unauthorised attacker to execute code over a network. This typically involves sending a malicious Excel file to a user via email or hosting it on a web server. When the victim opens the file, the application processes the corrupted memory reference, leading to arbitrary code execution on the host system.
Affected versions
Multiple editions of Microsoft Office are impacted by this vulnerability. Affected products include Microsoft 365 Apps for Enterprise before the latest security release, Microsoft Office 365 for Mac before publication, and Microsoft Office LTSC 2021 before version 16.0.14334.20974. Additionally, Microsoft Office LTSC 2024 is vulnerable before version 16.0.17932.21056. Mac users running Office LTSC 2021 or 2024 are also affected before their respective publication dates.
Mitigation
- Update Microsoft 365 Apps for Enterprise to the latest security release immediately.
- Patch Microsoft Office LTSC 2021 to version 16.0.14334.20974 or later.
- Upgrade Microsoft Office LTSC 2024 to version 16.0.17932.21056 or later.
- Ensure Mac versions of Office 365 and LTSC are updated to the latest published builds.
Why it matters
Teams usually treat remote code execution flaws with urgency because they bypass standard access controls. A use-after-free error is particularly dangerous as it can allow attackers to take full control of the application process. Security operations should verify that all Excel instances are patched, as unpatched systems remain exposed to network-based attacks. Regular patching reduces the window of opportunity for attackers to exploit known memory corruption bugs.
Background: National Vulnerability Database
The National Vulnerability Database provides standard identifiers for software flaws. You use these identifiers to automate patching and verify vendor claims. Small teams should cross-reference database entries with their IT asset inventory to prioritise fixes and avoid wasting time on irrelevant alerts.
Read the full guide: National Vulnerability Database: Small Business Action Plan
What to do and how to stay safe: Microsoft
- Audit your environment to identify all installations of Microsoft Excel, including LTSC versions.
- Verify that every instance is updated to the versions specified in the advisory.
- Monitor network traffic for unusual outbound connections from Excel processes.
- Educate users to avoid opening unsolicited Excel files from unknown sources.
Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-100212?
The National Vulnerability Database rates the vulnerability at 8.8, which is classified as high severity.
Which Microsoft products are affected by this flaw?
Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, and their Mac LTSC counterparts are affected.
Can an attacker exploit this without authentication?
Yes, the advisory states that an unauthorised attacker can execute code over a network without prior authentication.
