CVE-2026-32199Patch(microsoft / 365_apps)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch microsoft 365_apps systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

microsoft CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32199

Weakness type (CWE)

CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

365_apps
excel
office
office_long_term_servicing_channel

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-04-14); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

microsoft

Products

365_appsexcelofficeoffice_long_term_servicing_channeloffice_online_server

5 versions affected across 5 products

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Patch

250.0%

Disclosure

125.0%

General

125.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-14	3	Disclosure1Patch2
2026-04-15	1	General1

Full discourse4 posts

Haifei Li@HaifeiLi177d
Patch
Today (Patch Tuesday) Microsoft patched three new Office bugs I recently discovered and reported: - Microsoft Word Remote Code Execution Vulnerability (CVE-2026-33095) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33095 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2026-32199) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32199 - Microsoft Word Remote Code Execution Vulnerability (CVE-2026-23657) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23657 More to come.:)
Post summary
The author reports that Microsoft has patched three Remote Code Execution vulnerabilities in Office, providing official update links and acknowledging their discovery.
014088158.3K
8.9K followersView on X
CVE@CVEnew176d
General
CVE-2026-32199 Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. https://www.cve.org/CVERecord?id=CVE-2026-32199
Post summary
A newly disclosed CVE-2026‑32199 implicates a use‑after‑free flaw in Excel that permits local code execution, but no proof of concept, exploit tool, patch, or evidence of active exploitation is presented.
0000096
57.2K followersView on X
WindowsForum@windowsforum177d
Patch
🪟 Excel RCE CVE-2026-32199: Microsoft is using “we’re confident” language… aka patch before it becomes a weekend hobby. If it’s in Office, it’s everyone’s problem. https://windowsforum.com/threads/microsoft-excel-rce-cve-2026-32199-why-patch-now-based-on-microsoft-confidence.413098/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #RemoteCodeExecution #MicrosoftExcel #VulnerabilityPatching https://t.co/QcYNUUvg5T
Post summary
The tweet highlights an Excel RCE vulnerability (CVE‑2026‑32199) and stresses the importance of applying the patch promptly to mitigate the risk.
0000040
1.1K followersView on X
Red Hornet Intel@RedHornet_Intel177d
Disclosure
CVE-2026-32199 | Microsoft 365 Apps for Enterprise | Remote Code Execution Description Use-after-free vulnerability in Microsoft Office Excel allows unauth attacker to achieve RCE locally by tricking user into opening malicious Excel file. Severity: High Exploitation: Unknown Public PoC: Unknown Patch Available: Yes Affected Product: Microsoft 365 Apps for Enterprise Affected Version: >= 16.0.1 and < https://aka.ms/OfficeSecurityReleases Sources Vendor: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32199
Post summary
The post announces a new use‑after‑free RCE vulnerability in Microsoft 365 Apps for Enterprise with an available patch, but no PoC or exploit code is disclosed.
0000065
8 followersView on X

CPE platform detail13 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

13 of 13 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	365_apps	-	-	x64
App	microsoft	365_apps	-	-	x86
App	microsoft	excel	2016	-	x64
App	microsoft	excel	2016	-	x86
App	microsoft	office	2019	-	x64
App	microsoft	office	2019	-	x86
App	microsoft	office_long_term_servicing_channel	2021	-	x64
App	microsoft	office_long_term_servicing_channel	2021	-	x86
App	microsoft	office_long_term_servicing_channel	2021	macos	-
App	microsoft	office_long_term_servicing_channel	2024	-	x64
App	microsoft	office_long_term_servicing_channel	2024	-	x86
App	microsoft	office_long_term_servicing_channel	2024	macos	-
App	microsoft	office_online_server	-	-	-

Explore more

Back to dashboard microsoft CVEs 365_apps vulnerabilities

What researchers are saying

CVE-2026-32199

WindowsForum[verified]@windowsforumPatch

The tweet highlights an Excel RCE vulnerability (CVE‑2026‑32199) and stresses the importance of applying the patch promptly to mitigate the risk.

Red Hornet Intel[verified]@RedHornet_IntelDisclosure

The post announces a new use‑after‑free RCE vulnerability in Microsoft 365 Apps for Enterprise with an available patch, but no PoC or exploit code is disclosed.

Haifei Li@HaifeiLiPatch

The author reports that Microsoft has patched three Remote Code Execution vulnerabilities in Office, providing official update links and acknowledging their discovery.

CVE@CVEnewGeneral

A newly disclosed CVE-2026‑32199 implicates a use‑after‑free flaw in Excel that permits local code execution, but no proof of concept, exploit tool, patch, or evidence of active exploitation is presented.