Loading vulnerability…
Use-after-free RCE in Microsoft Office Excel
CVE-2026-40359 is a Microsoft Office Excel vulnerability caused by a use-after-free condition. Microsoft classifies it as a remote code execution vulnerability, although the attack executes locally on the victim host after delivery of a specially crafted malicious Office file. Exploitation requires an attacker to send or otherwise deliver the malicious file to a target user and convince them to open it in Excel. Microsoft states that the Preview Pane is not an attack vector. The issue affects Microsoft Office Excel and can allow an unauthorized attacker to execute arbitrary code in the context of the user who opens the file.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution on the victim system in the security context of the user who opens the malicious Excel/Office file. Microsoft rates the vulnerability Important with CVSS 3.1 base score 7.8 and indicates high impact to confidentiality, integrity, and availability. In practical terms, exploitation can enable compromise of user data, modification of files or application state, and disruption of system or application availability, subject to the privileges of the affected user account.
If you can’t patch tonight, do this now.
Until patching is complete, reduce exposure by preventing users from opening untrusted or unsolicited Office files, especially those delivered via phishing or other social-engineering channels. Enforce email and web content filtering for malicious attachments, restrict document handling from untrusted sources, and reinforce user awareness controls. Microsoft specifically notes that the Preview Pane is not an attack vector for this issue.
Patch, then assume compromise.
Apply Microsoft's official security update for the affected Microsoft Office Excel versions as provided through the Microsoft Security Update Guide/MSRC advisory for CVE-2026-40359. Standard remediation is to update all affected Office/Excel installations to the patched build and verify deployment across endpoints likely to process Office documents.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.