Microsoft Office Excel Use-After-Free Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

• Microsoft 365 Apps for Enterprise: The record marks baseline 16.0.1 as affected on 32-bit and x64 systems and uses Microsoft's Office Security Releases channel as the comparison boundary; no numeric fixed build is supplied for this branch.
• Microsoft Office 365 for Mac: Versions below 16.114.26101123 are affected; Microsoft identifies 16.114.26101123 as the fixed version for this branch.
• Microsoft Office LTSC for Mac 2021: Versions below 16.114.26101123 are affected; the identified fixed version is 16.114.26101123.
• Microsoft Office LTSC for Mac 2024: Versions below 16.114.26101123 are affected; the identified fixed version is 16.114.26101123.
• Microsoft Office LTSC 2021: Versions below 16.0.14334.20974 are affected on both 32-bit and 64-bit editions; the identified fixed version is 16.0.14334.20974.
• Microsoft Office LTSC 2024: Versions below 16.0.17932.21056 are affected on both 32-bit and 64-bit editions; the identified fixed version is 16.0.17932.21056.
• Office Online Server: Versions below 16.0.10417.20228 are affected; the identified fixed version is 16.0.10417.20228. The status of branches or products not listed here should not be inferred from this record.

Microsoft Office Excel contains a use-after-free condition, classified as CWE-416. The available evidence does not identify the freed object, vulnerable routine, file format, or exact attacker-controlled input. The flaw is network-reachable, requires no prior privileges, and requires user interaction; attack complexity is low. The evidence therefore supports a remote code-execution path when a user interacts with attacker-provided content, but the precise trigger and delivery mechanism remain unknown. The affected scope spans the desktop Office, Mac Office, and Office Online Server branches listed below.

• Reachability: Network.
• Authentication and privileges: No prior privileges are required.
• User interaction: Required. The record does not specify the exact user action.
• Complexity: Low according to the supplied structured data.
• Exploitation status: The record marks public_exploit as false, while Microsoft's VEX classifies exploit code maturity as unproven. This does not establish that exploitation has never occurred in the wild. No known-exploited or ransomware-campaign status is supplied.

The flaw can result in remote code execution in Microsoft Office Excel when the user-interaction condition is met. The structured data indicates high potential impact to confidentiality, integrity, and availability, while the security scope remains unchanged. The absence of a prior privilege requirement increases the risk to users or services that process untrusted content, but required user interaction is a practical limitation on the attack path. The available evidence does not confirm privilege escalation, a cross-boundary security effect, or a specific compromise scenario.

A successful exploit could allow code execution within the security context of the affected Office process, creating risks to the confidentiality, integrity, and availability of data or services accessible to that process. On workstations, the main concern is exposure of or unauthorized changes to files and data available to the user. Office Online Server deployments should also be included because the vulnerable processing path can affect server-side document services. The record does not establish a specific breach, victim, or data-loss scenario.

1. Deploy Microsoft's security updates:

• Microsoft Office LTSC 2021: update to the fixed build 16.0.14334.20974 for both 32-bit and 64-bit editions.
• Microsoft Office LTSC 2024: update to the fixed build 16.0.17932.21056 for both 32-bit and 64-bit editions.
• Microsoft Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024: update to 16.114.26101123.
• Office Online Server: update to 16.0.10417.20228.
• Microsoft 365 Apps for Enterprise: deploy the security update through the Microsoft Office Security Releases channel because the source does not provide a numeric fixed build for this branch.

1. Microsoft states that the vulnerability was addressed by updates released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates listing. This was an informational change; customers that already installed the October 2026 updates do not need further action for that omission.
2. Recheck inventory and installed builds after deployment for every product branch. Do not infer that parallel branches or releases not listed in the evidence are unaffected.
3. The supplied record does not provide a separate workaround beyond applying Microsoft's fix. If patching cannot be completed immediately, consult Microsoft's current mitigation guidance for the confirmed product and release branch.

1. Inventory Microsoft Office Excel installations on workstations, Mac systems, and servers running Office Online Server, recording the platform and 32-bit or 64-bit architecture where available.
2. Compare installed builds with the fixed boundaries: Office LTSC 2021 must reach 16.0.14334.20974, Office LTSC 2024 must reach 16.0.17932.21056, Mac Office branches must reach 16.114.26101123, and Office Online Server must reach 16.0.10417.20228.
3. For Microsoft 365 Apps for Enterprise, verify the Office Security Releases channel and confirm that the relevant security update is deployed; the supplied data does not provide a numeric fixed build for this branch.
4. Verify deployment of the October 2026 security updates. Microsoft states that those updates addressed the vulnerability even though the CVE was inadvertently omitted from that month's Security Updates listing.
5. Review telemetry for abnormal Excel or Office crashes and suspicious Office activity as a precaution, but treat this only as generic monitoring. No specific log event or IOC is confirmed for this vulnerability, and the absence of log evidence does not prove that a system is safe.