Loading vulnerability…
Microsoft Excel Heap-Based Buffer Overflow Remote Code Execution
CVE-2026-40362 is an Important-severity heap-based buffer overflow in Microsoft Office Excel. Processing a specially crafted Office file can corrupt heap memory and permit code execution in the context of the user who opens the file. Microsoft classifies the issue as a local attack vector despite the Remote Code Execution title; the Preview Pane is not an attack vector.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary code execution with the privileges of the logged-on user. It can result in high confidentiality, integrity, and availability impact on the affected system, subject to the permissions of the compromised user account.
If you can’t patch tonight, do this now.
Until updates are deployed, reduce exposure to unsolicited or untrusted Office documents through mail and web filtering, user awareness controls, and document-handling policies. Prevent users from opening unexpected Office files obtained from untrusted sources.
Patch, then assume compromise.
Apply the Microsoft security update addressing CVE-2026-40362 through the applicable Microsoft Office or Microsoft 365 update channel. Ensure affected Excel installations receive the vendor-provided fixed build.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.