Excel — CraftedSignal Threat Feed

Microsoft Office Excel Use-After-Free Vulnerability (CVE-2026-32198)

hello@craftedsignal.io — Wed, 15 Apr 2026 12:00:00 +0000

CVE-2026-32198 is a critical use-after-free vulnerability affecting Microsoft Office Excel. Discovered and reported on April 14, 2026, this vulnerability allows an unauthenticated, local attacker to execute arbitrary code on a target system. The vulnerability stems from improper memory management within Excel while processing malformed or specially crafted Excel files. Successful exploitation of this flaw could lead to complete system compromise, allowing attackers to install malware, steal sensitive data, or pivot to other systems within the network. This vulnerability impacts systems running vulnerable versions of Microsoft Office Excel.

Attack Chain

An attacker crafts a malicious Excel file designed to trigger the use-after-free vulnerability.
The attacker delivers the malicious Excel file to the victim via social engineering.
The victim opens the malicious Excel file using a vulnerable version of Microsoft Office Excel.
Excel attempts to access a memory location that has already been freed, triggering the vulnerability.
The attacker gains control of the execution flow due to the use-after-free condition.
The attacker injects malicious code into the Excel process’s memory space.
The injected code executes with the privileges of the user running Excel.
The attacker can install malware, steal data, or perform other malicious activities on the system.

Impact

Successful exploitation of CVE-2026-32198 allows an attacker to execute arbitrary code on a vulnerable system. This can lead to complete system compromise, data theft, malware installation, and potentially further network compromise. Organizations that rely heavily on Excel for data processing and analysis are particularly at risk.

Recommendation

Apply the security patch released by Microsoft to address CVE-2026-32198 on all systems running Microsoft Office Excel.
Deploy the Sigma rules in this brief to your SIEM to detect potential exploitation attempts of CVE-2026-32198.
Educate users about the risks of opening suspicious or unexpected Excel files delivered via email or other means.

Microsoft Excel Use-After-Free Vulnerability (CVE-2026-32189)

hello@craftedsignal.io — Wed, 15 Apr 2026 12:00:00 +0000

CVE-2026-32189 is a use-after-free vulnerability affecting Microsoft Office Excel. This flaw can be exploited by an attacker to execute arbitrary code on a vulnerable system. The vulnerability arises from improper memory management within the application when handling specific Excel files. While the exact versions affected are not detailed, the vulnerability was reported on April 14, 2026. Successful exploitation requires a user to open a specially crafted Excel file, which triggers the use-after-free condition. This vulnerability is significant because it allows for local code execution, potentially leading to further compromise of the affected system. Defenders should prioritize patching vulnerable Excel installations and implement detection measures to identify potential exploitation attempts.

Attack Chain

Attacker crafts a malicious Excel file designed to trigger the use-after-free vulnerability (CVE-2026-32189).
The attacker delivers the malicious Excel file to the victim via email or other means.
The victim opens the malicious Excel file using a vulnerable version of Microsoft Excel.
Excel attempts to access a memory location that has already been freed, triggering the use-after-free condition.
The attacker leverages the memory corruption to overwrite critical data structures in Excel’s memory space.
The attacker redirects program execution to attacker-controlled code within the Excel process.
The attacker executes arbitrary code with the privileges of the user running Excel.
The attacker can then install malware, steal sensitive data, or perform other malicious actions on the local system.

Impact

Successful exploitation of CVE-2026-32189 allows an attacker to execute arbitrary code on the victim’s machine. This can lead to a complete compromise of the system, including data theft, malware installation, and privilege escalation. The vulnerability poses a significant risk to organizations that rely on Microsoft Excel for daily operations, as a single compromised user can provide a foothold for further attacks within the network. While specific victim counts are unavailable, the widespread use of Microsoft Excel suggests a potentially large attack surface.

Recommendation

Apply the security update released by Microsoft to patch CVE-2026-32189 immediately (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32189).
Deploy the provided Sigma rules to detect potential exploitation attempts based on suspicious process creation and file activity.
Monitor process creation events for unusual child processes spawned by Excel.exe, using logsource category process_creation.
Monitor file access events for Excel accessing unusual locations or creating suspicious files, using logsource category file_event.

Microsoft Excel Out-of-Bounds Read Vulnerability (CVE-2026-32188)

hello@craftedsignal.io — Wed, 15 Apr 2026 12:00:00 +0000

CVE-2026-32188 describes an out-of-bounds read vulnerability affecting Microsoft Office Excel. According to the NVD, this vulnerability allows an unauthorized attacker to disclose information locally. The CVSS v3.1 score is 7.1, indicating a high severity. The vulnerability resides within how Excel parses certain file formats, potentially allowing a malicious actor to craft a file that, when opened, causes Excel to read memory outside of allocated buffers. This can lead to the disclosure of sensitive information contained in the application’s memory space. While the source doesn’t specify affected versions or a specific attack campaign, successful exploitation requires user interaction to open the malicious file. Defenders should focus on detecting abnormal process behavior in Excel and promptly applying available patches.

Attack Chain

An attacker crafts a malicious Excel file designed to trigger the out-of-bounds read vulnerability (CVE-2026-32188).
The attacker delivers the crafted Excel file to a victim via social engineering or other means.
The victim opens the malicious Excel file.
Excel attempts to parse the malformed data structures within the file.
Due to the vulnerability, Excel reads memory outside the intended buffer boundaries.
The out-of-bounds read results in the disclosure of sensitive information from Excel’s memory.
The attacker retrieves the disclosed information, potentially containing sensitive data or internal application state.
The attacker uses the disclosed information for further malicious activities.

Impact

Successful exploitation of CVE-2026-32188 can lead to the disclosure of sensitive information from the victim’s system. While the vulnerability is local, the disclosed information could include credentials, internal network details, or other sensitive data that could be used for further attacks. The number of potential victims is broad, encompassing any user of Microsoft Office Excel. The impact could range from minor data leaks to more significant compromises depending on the nature of the disclosed information.

Recommendation

Apply the security update released by Microsoft to patch CVE-2026-32188 on all affected systems. Reference the Microsoft advisory linked in the references section for specific instructions.
Implement the Sigma rule “Detect Suspicious Excel Process Creation” to identify potentially malicious Excel activity.
Monitor for unusual network connections originating from Excel processes after opening untrusted documents.
Educate users about the risks of opening unsolicited or suspicious Excel files to prevent initial access.