CVE-2026-88145

Executive Summary

CVE-2026-88145 is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel that allows an unauthorized attacker to execute arbitrary code over a network. The vulnerability carries a CVSS 3.1 base score of 8.8 (High), driven by network attack vector, low attack complexity, and high confidentiality, integrity, and availability impact, with the sole mitigating factor being the requirement for user interaction (UI:R). Any system running an affected version of Microsoft Excel is potentially exposed, and successful exploitation yields code execution in the context of the victim user. As of this report, the vulnerability is unpatched per all tracked sources, no public proof-of-concept or exploit code exists, and it has not been added to CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

CVE-2026-88145 is classified under CWE-122, Heap-based Buffer Overflow. This flaw class occurs when a program writes more data to a buffer allocated in the heap region of memory than that buffer can hold. Heap overflows are distinct from stack overflows in that the corrupted memory consists of dynamically allocated structures — chunk headers, adjacent object metadata, or function pointers stored in neighboring allocations — rather than return addresses on the call stack.

The NVD description states that the vulnerable component is Microsoft Office Excel and that the overflow permits an unauthorized attacker to execute code over a network. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms:

• AV:N (Network): The attack is delivered remotely, consistent with a malicious document or data stream reaching the Excel parsing engine.
• AC:L (Low): No specialized conditions or race windows are required; a deterministic trigger suffices.
• PR:N (None): The attacker needs no prior credentials or authentication on the target system.
• UI:R (Required): A user must take an action — canonically, opening a crafted Excel file or interacting with attacker-supplied content — for exploitation to proceed. This is the classic client-side document-parsing threat model.
• S:U (Unchanged): Exploitation does not cross a security authority boundary; impact is confined to the vulnerable component's security scope.
• C:H/I:H/A:H: Full compromise of confidentiality, integrity, and availability within the exploited context.

The precise code path, parsing routine, record type, or object involved in the overflow is not specified in the available NVD description or CNA title. No function names, structure names, file format fields, or vulnerable parsing components are disclosed in the source intelligence. Any statement identifying a specific Excel record type, worksheet structure, or memory allocation routine would be speculative and is therefore omitted.

At the vulnerability-class level, the mechanism is: Excel parses attacker-controlled input into a heap-allocated buffer whose size is computed or validated incorrectly, permitting an oversized write past the allocation boundary. Depending on heap layout, this can corrupt adjacent heap metadata or embedded pointers, which is then leveraged to redirect execution flow. In modern Office builds this generally requires additional primitives (heap grooming, information disclosure to defeat ASLR) to convert the corruption into reliable code execution, though the CVSS scoring (AC:L) indicates the vendor's assessment that exploitation difficulty is not inherently high once the malformed input is delivered.

The attack surface is the document/data ingestion path of Excel, reachable whenever a user opens a file supplied by an untrusted party. Because the vector is AV:N, delivery is typically via email attachment, web download, or a hosted file — the vulnerability is triggered at parse time on the client.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-88145 as of this report. The following attack chain is inferred strictly from the vulnerability class (heap-based buffer overflow, CWE-122) and the CVSS vector; no specific implementation details are asserted.

1. Reconnaissance / target identification. The attacker identifies a target organization or individual running an affected Microsoft Office Excel build. Because no affected version range is published, precise version targeting is not possible from public data alone. Delivery infrastructure (email, file-sharing, or web hosting) is prepared to distribute a weaponized file.

2. Triggering the flaw. The attacker crafts a document that, when parsed by Excel, causes the vulnerable parsing routine to write data beyond the bounds of a heap allocation. The specific malformed structure that induces the overflow is not publicly documented. The victim must open or render the malicious content, satisfying UI:R. No authentication to the victim host is needed (PR:N), and delivery is remote (AV:N).

3. Payload / execution (vulnerability class). The overflow corrupts adjacent heap memory. In typical heap-overflow exploitation, the attacker arranges the heap so that the corrupted region overlaps a structure whose contents influence control flow (for example, a pointer that is later dereferenced). Control is then redirected toward attacker-controlled data. Because ASLR and other exploit mitigations are present in modern Office, a fully weaponized chain would generally require a separate memory-disclosure step to leak addresses — that step is not described in the available data and is not asserted here. The end objective, per CVSS (C/I/A:H, S:U), is arbitrary code execution within the security context of the user who opened the file.

4. Post-exploitation impact. Successful exploitation yields code execution as the victim user. Typical consequences include establishing persistence, harvesting data accessible to that user (including other documents and credentials), lateral movement using the user's privileges and tokens, and potentially full system compromise if the user holds elevated rights. Because scope is Unchanged, the direct impact is bounded to the exploited Excel process and its user context, but that context often provides a viable foothold for further intrusion.

Impact Assessment

The CVSS 3.1 base score is 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Business impact: Microsoft Excel is ubiquitous in enterprise environments, appearing on nearly every knowledge-worker endpoint. A remotely triggerable, low-complexity code-execution flaw requires only that a user open a malicious file, making it well suited to phishing and social-engineering delivery — the dominant initial-access vector for ransomware and espionage operations. Blast radius is potentially organization-wide, limited primarily by the user-interaction requirement and by the availability of a working exploit chain.

Current risk modifiers: EPSS has not yet scored this CVE, so no exploitation-likelihood percentile is available. There is no evidence of exploit-in-the-wild, no CISA KEV listing, and no public PoC. These factors currently temper real-world urgency, but a client-side Office RCE at 8.8 is a high-value target that mature adversaries routinely develop weaponization for after patch or disclosure.

Detection Guidance

Detection below is necessarily generic: the exact trigger content, file structure, and process behavior are undocumented. Rules should be tuned to environment baselines to avoid high false-positive rates.

Sigma Rule

title: Suspicious Office Excel Child Process Spawning (Potential CVE-2026-88145 Exploitation)
id: 8f3b2c1a-2026-4e11-9d7a-000088145excel
status: experimental
description: Detects Excel spawning unusual child processes consistent with post-exploitation code execution following a heap-based buffer overflow (CWE-122) in Microsoft Office Excel.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88145
author: Security Research
date: 2026/01/01
tags:
  - attack.t1203
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\EXCEL.EXE'
  selection_susp_children:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_susp_children
falsepositives:
  - Legitimate Excel add-ins or macros that intentionally launch shells or scripts
  - Automation workflows in finance/operations
level: high

YARA Rule

rule EXPLOIT_CVE_2026_88145_Excel_HeapOverflow_Generic
{
    meta:
        description = "Generic heuristic detection for suspicious Excel content associated with a heap-based buffer overflow (CWE-122) in Microsoft Office Excel (CVE-2026-88145). No exploit-specific signature is publicly available; this rule targets generic high-risk Excel indicators only."
        author = "Security Research"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88145"
        cwe = "CWE-122"
        severity = "high"

    strings:
        $sig_zip = { 50 4B 03 04 }                 // OOXML files are ZIP archives
        $f_xlsx = "xl/workbook.xml" ascii wide
        $f_sheet = "xl/worksheets/sheet" ascii wide
        $f_vba1 = "xl/vbaProject.bin" ascii wide
        $f_emb  = "xl/embeddings/" ascii wide
        $f_ole  = { D0 CF 11 E0 A1 B1 1A E1 }      // legacy OLE compound file

    condition:
        uint32(0) == 0x04034b50 or $f_ole at 0
        and (
            2 of ($f_xlsx, $f_sheet, $f_vba1, $f_emb)
            or filesize < 20KB   // anomalously small files that still contain OOXML markers
        )
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-88145 Possible Microsoft Excel Heap Overflow File Exfiltration/Beacon (CWE-122)"; flow:established,to_server; content:"|50 4B 03 04|"; depth:4; content:"xl/"; http_client_body; classtype:attempted-user; reference:cve,2026-88145; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88145; metadata:created_at 2026_01_01, cve CVE-2026-88145, cwe CWE-122; sid:8814526; rev:1;)

Note: Because the overflow is triggered at client-side document parse time and the NVD description does not identify a network protocol, service, or URL path, there is no reliable network signature for the trigger itself. The rule above is a coarse heuristic for anomalous Excel-format file transport and should be tuned to reduce false positives.

Elastic Detection

sequence by host.name, user.name with maxspan=60s
  [ process where event.type == "start" and process.parent.name : "EXCEL.EXE" ]
  [ process where event.type == "start" and
      process.name : ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe") ]

Splunk SPL Query

index=windows EventCode=4688
| eval parent=lower(ParentImage), child=lower(NewProcessName)
| where like(parent, "%\\excel.exe")
| where like(child, "%\\cmd.exe") OR like(child, "%\\powershell.exe") OR like(child, "%\\wscript.exe")
        OR like(child, "%\\cscript.exe") OR like(child, "%\\mshta.exe") OR like(child, "%\\rundll32.exe")
        OR like(child, "%\\regsvr32.exe") OR like(child, "%\\certutil.exe") OR like(child, "%\\bitsadmin.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(NewProcessName) as children by ComputerName, User, parent
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="windows,sysmon,exploit,">
  <rule id="88145" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">\\\\EXCEL\.EXE$</field>
    <field name="win.eventdata.image">\\(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe$</field>
    <description>CVE-2026-88145: Suspected Excel child process spawned - possible heap overflow code execution (CWE-122)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>exploit_attempt,pci_dss_10.6,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, vendor advisory, workaround, or fixed version is available from any tracked source. The vendor fix is not identified. The following guidance is generic hardening for a client-side Office RCE and does not constitute a vendor-provided fix.

1. Immediate mitigations (compensating controls pending a patch):

• Enforce attachment filtering and block/mark external OOXML and legacy Excel files from untrusted senders at the email gateway and web proxy.
• Configure Microsoft Defender for Office / Windows Attack Surface Reduction (ASR) rules, particularly "Block Office applications from creating child processes" and "Block Office applications from creating executable content."
• Enable Protected View and Application Guard for files from the internet; ensure Mark-of-the-Web is honored.
• Restrict or disable execution of macros and embedded objects where operationally feasible.
• Apply least-privilege so that compromised user contexts are not local administrators.
• Disable Excel preview handlers where not required, reducing parse-time exposure in file explorers and mail clients.

2. Patch / upgrade steps:

• Monitor Microsoft's Security Update Guide and the MSRC advisory channel for a fix referencing CVE-2026-88145. Because no affected version range is published, asset inventories should record all deployed Office/Excel builds so the eventual patched build can be matched quickly.
• Once released, prioritize patching of internet-facing and end-user endpoints, then stage to remaining fleet.
• Validate installs post-deployment and re-scan for the previously deployed vulnerable build.

3. Long-term hardening:

• Maintain continuous inventory of Microsoft Office versions across the estate to close the version-attribution gap.
• Adopt an allowlist/application-control model to constrain what Excel can spawn.
• Integrate threat intel feeds (EPSS, CISA KEV) to reprioritize automatically if this CVE is scored or exploited.
• Conduct user awareness training on opening unsolicited documents.
• Run periodic purple-team exercises simulating malicious-document delivery to validate detection coverage.

References

1. NVD — CVE-2026-88145: https://nvd.nist.gov/vuln/detail/CVE-2026-88145
2. Microsoft Security Update Guide / MSRC advisories: https://msrc.microsoft.com/update-guide
3. CWE-122 Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
4. CISA Known Exploited Vulnerabilities catalog (currently does NOT list CVE-2026-88145): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS (score not yet available for this CVE): https://www.first.org/epss/

Threat actor / exploit-in-the-wild status: No public PoC, no exploit code, no Nuclei template, and no CISA KEV listing exist for CVE-2026-88145 as of this report. No known threat actor campaigns are attributed to this CVE in the available intelligence.