Advisory · CVE-2026-108446
Use-after-free in Microsoft Excel can run code from a crafted spreadsheet, and hits Office Online Server too
A use-after-free flaw in Microsoft Excel allows code execution via a crafted spreadsheet, and the vendor record also lists Office Online Server before 16.0.10417.20228 as affected. Microsoft rates it CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Microsoft Excel
- Identifier / CWE
- CVE-2026-108446
CWE-416 - Action timing
- Immediate
Explain it like I’m five
Excel keeps a pointer to memory it has already released; a crafted spreadsheet makes it follow that pointer into attacker data.
- 01Crafted document delivered
An attacker sends a malicious Office file by email, chat, or a download link.
- 02User opens the file
The victim opens the file in Microsoft Excel, reaching the vulnerable parsing code.
- 03Memory flaw trips
The use after free corrupts memory handling inside the application.
- 04Attacker code runs
Code executes in the context of the user who opened the document.
What happened
Microsoft disclosed CVE-2026-108446 in its October 2026 security release: a use after free (CWE-416) in Microsoft Excel. An unauthenticated attacker needs a user to open a crafted file; the flaw then runs code in that user’s context. Microsoft rates it CVSS 3.1 8.8.
The vendor record lists as affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021 (before 16.0.14334.20974) and Office LTSC 2024 (before 16.0.17932.21056), plus the Mac builds listed in the vendor record (before 16.114.26101123), and Office Online Server before 16.0.10417.20228. Use the MSRC bulletin for the exact build table for your channel.
What to do
- Inventory Microsoft 365 Apps, Office LTSC 2021 and LTSC 2024 installs, including Mac builds where the vendor record lists them.
- Apply the October 2026 Microsoft security updates so builds reach at least the fixed thresholds in the MSRC bulletin linked above.
- Treat unsolicited Office documents as hostile until patching lands: block or detonate attachments at the mail gateway where possible.
- Hunt endpoint telemetry for Office processes spawning shells, script hosts, or unexpected child processes around document opens.
- Verify the installed build number after updating, not just that an update ran.
Management note
Office document parsing remains one of the most reliable initial-access paths into enterprises. An 8.8 that only needs a document open belongs on the fast patch ring, ahead of routine monthly cadence.