Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
5 versions affected across 5 products
| Date | Total | Labels |
|---|
| 2026-05-12 | 1 | Patch1 |
| 2026-06-24 | 1 | Disclosure1 |
| 2026-07-09 | 1 | Disclosure1 |
| 2026-09-18 | 1 | Patch1 |
Micropatches released for Microsoft Excel Remote Code Execution Vulnerability (CVE-2026-40362) https://0patch.com/blog/micropatches-released-for-microsoft-excel-remote-code-execution-vulnerability-cve-2026-40362 https://t.co/dBgvPU0TDw
Post summary
The tweet announces that micropatches have been released for CVE-2026-40362, a remote code execution vulnerability in Microsoft Excel, and links to the 0patch blog for details.
NEW S2W Report: Microsoft Office Excel #Vulnerability - CVE-2026-40362 S2W Threat Intelligence Center TALON analyzed CVE-2026-40362, a #Microsoft Office Excel Remote Code Execution vulnerability first discovered by Jeongmin Choi with S2W and Haein Lee with KAIST Hacking Lab. This vulnerability is a Heap-based Buffer Overflow vulnerability caused by improper boundary checking in the PivotTable record loader of Microsoft Office #Excel. The flaw stems from the handler IRLOADSXVIEW::HrLoadSXDI14 failing to validate the SXDI data item count. When the count is zero, a threat actor can write controlled values before the start of the array buffer, corrupting heap memory as soon as a manipulated workbook is opened. Explore the report by S2W Threat Intelligence Center TALON at the link below. https://s2w.inc/en/resource/detail/1095?utm_source=twitter&utm_medium=social-posts&utm_campaign=ti-reports&utm_term=vulnerability&utm_content=cve-2026-40362
Post summary
The report discloses a heap‑based buffer overflow in Microsoft Office Excel’s PivotTable loader, outlining how improper boundary checks enable heap corruption, but it does not provide a PoC, exploit, or patch.
Excel also receives critical attention: CVE-2026-40359 (Excel RCE, Important) — Memory corruption via spreadsheet cells CVE-2026-40362 (Excel RCE, Important) — Malicious formula injection chains
Post summary
The text announces two Excel RCE vulnerabilities with specific technical details, but provides no evidence of PoCs, exploits, patches, or active exploitation.
🧨 CVE-2026-40362 Excel RCE: because apparently spreadsheets aren’t scary enough—now they can run code. Patch fast, and treat “friendly” .xlsx like a suspicious download. #Windows #Security https://windowsforum.com/threads/cve-2026-40362-excel-rce-patch-harden-and-tame-malicious-workbook-handling.417957/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #PatchManagement #ExcelSecurity #OfficeRce #DocumentSupplyChain https://t.co/2nptVsea3f
Post summary
The post announces the CVE-2026-40362 Excel RCE vulnerability and urges readers to apply a patch and treat .xlsx files with caution, without providing technical details or evidence of active exploitation.
13 of 13 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | microsoft | 365_apps | - | - | x64 |
| App | microsoft | 365_apps | - | - | x86 |
| App | microsoft | excel | 2016 | - | x64 |
| App | microsoft | excel | 2016 | - | x86 |
| App | microsoft | office | 2019 | - | x64 |
| App | microsoft | office | 2019 | - | x86 |
| App | microsoft | office_long_term_servicing_channel | 2021 | - | x64 |
| App | microsoft | office_long_term_servicing_channel | 2021 | - | x86 |
| App | microsoft | office_long_term_servicing_channel | 2021 | macos | - |
| App | microsoft | office_long_term_servicing_channel | 2024 | - | x64 |
| App | microsoft | office_long_term_servicing_channel | 2024 | - | x86 |
| App | microsoft | office_long_term_servicing_channel | 2024 | macos | - |
| App | microsoft | office_online_server | - | - | - |