Key points
- CVE-2026-100212 allows remote code execution via a use-after-free error in Excel.
- The flaw affects Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024.
- Mac versions of Office 365 and LTSC are also vulnerable until patched.
Microsoft has released security updates to address CVE-2026-100212, a high-severity remote code execution vulnerability in Microsoft Office Excel. The flaw is rated CVSS 8.8 and stems from a use-after-free error. An unauthorized attacker can exploit this issue over a network to execute arbitrary code on affected systems. This follows similar high-severity updates for WPF components, as Patch Review reported on 2026-10-14.
In plain English
This vulnerability exists because the software fails to properly manage memory when an object is deleted. The program continues to reference the freed memory space, which an attacker can manipulate. This allows malicious code to run on the system. The risk is significant because it can be triggered remotely, meaning the attacker does not need physical access to the machine. The specific mechanism involves a use-after-free error in the Excel application.
The background
The National Vulnerability Database lists the weakness as CWE-416. Microsoft’s official advisory confirms that the issue allows an unauthorized attacker to execute code over a network. This type of memory corruption flaw is common in complex applications like Excel. It requires precise conditions to trigger, but the potential impact is severe. Previous reports, such as the Adobe Experience Manager flaw on 2026-10-13, highlight the ongoing risk of remote code execution in enterprise software.
What changes now
Organizations must update their Excel installations immediately. Affected products include Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021, and Office LTSC 2024. Specific version thresholds are defined in the advisory. For example, Office LTSC 2021 must be updated to version 16.0.14334.20974 or later. Mac users of Office LTSC 2021 and 2024 must also apply the latest updates available from Microsoft to mitigate this risk.
Who needs to act first
Teams usually prioritize systems that face the internet or handle sensitive data. Check whether your environment allows remote file processing. Test the update in a controlled group before rolling it out broadly. Back up critical configurations to ensure you can revert if issues arise. If a patch is not yet available for your specific version, restrict network access to untrusted files. Monitor logs for unusual activity that might indicate exploitation attempts.
What to do and how to stay safe: Microsoft
- Verify your current Excel version against the affected list in the advisory.
- Apply the latest security updates provided by Microsoft to all endpoints.
- Restrict the execution of macros and untrusted documents in your policy.
- Monitor network traffic for signs of remote exploitation attempts.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Excel versions are affected by CVE-2026-100212?
Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, and their Mac counterparts are affected.
Is there a fix available for this vulnerability?
Yes, Microsoft has released updates for the affected versions of Office and Excel.
What is the severity of this flaw?
The vulnerability is rated high with a CVSS score of 8.8.
