CVE-2026-47642Patch(microsoft / 365_apps)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch microsoft 365_apps systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

microsoft CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47642

Weakness type (CWE)

CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

365_apps
microsoft_365
office_2019
office_2021

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-07-15); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

microsoft

Products

365_appsmicrosoft_365office_2019office_2021office_2024office_online_server

1 version affected across 6 products

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Patch

266.7%

Disclosure

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	1	Patch1
2026-07-17	1	Disclosure1
2026-07-22	1	Patch1

Full discourse3 posts

Haifei Li@HaifeiLi86d
Patch
Cyber update after World Cup.:) Last week on July Patch Tuesday two of my Office bugs got patched: - Microsoft Word Remote Code Execution Vulnerability (CVE-2026-55032) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55032 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2026-47642) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47642 And happy to be recognized by @msftsecresponse again as an MVR this year (https://www.microsoft.com/en-us/msrc/blog/2026/07/congratulations-to-the-msrc-2026-most-valuable-security-researchers1), along with many super talented researchers.:)
Post summary
The author announces the July Patch Tuesday updates that remediate two Office RCE vulnerabilities, providing Microsoft update links, with no PoC or active exploitation reported.
1103152.5K
8.9K followersView on X
くろん｜情シスAIラボ@josys_AI_labo91d
Disclosure
Microsoft Office ExcelにUAF脆弱性。 CVE-2026-47642、CVSSv3スコア7.8（重要）。対象が地味に広い。 Microsoft 365 Apps、Office 2019、2021 LTSC、 2024 LTSC、Office Online Server まで。「うちはLTSCだから大丈夫」って思いがちなやつ、全部入ってる。 Excelファイル踏ませてローカルでコード実行。攻撃者にとって手順がシンプルなのが怖い。台帳でバージョン管理してない環境は今週中に棚卸しだけでもやっておくべき。
Post summary
Microsoft Office Excel has a UAF vulnerability (CVE-2026-47642) with a CVSS v3 score of 7.8, affecting a broad range of Office releases and enabling local code execution via crafted Excel files; affected organizations should inventory installations promptly.
1000060
18 followersView on X
Windows Forum@windowsforum93d
Patch
⚠️ Excel’s 7.8 RCE flaw proves “just opening a spreadsheet” is still a security event. Patch it—because attackers don’t need remote magic when the malware arrives in a workbook. https://windowsforum.com/threads/cve-2026-47642-update-excel-to-fix-7-8-rce-flaw.438656/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #RemoteCodeExecution #OfficeSecurity #MicrosoftExcel #Cve202647642 https://t.co/2sGd5sYHQV
Post summary
The post alerts users to a remote code execution flaw in Excel 7.8 (CVE‑2026‑47642) and urges them to apply the available patch, noting that attackers can exploit it simply by opening a malicious workbook.
0000011
1.2K followersView on X

CPE platform detail12 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

12 of 12 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	365_apps	-	-	x64
App	microsoft	365_apps	-	-	x86
App	microsoft	microsoft_365	-	macos	-
App	microsoft	office_2019	-	-	x64
App	microsoft	office_2019	-	-	x86
App	microsoft	office_2021	-	-	x64
App	microsoft	office_2021	-	-	x86
App	microsoft	office_2021	-	macos	-
App	microsoft	office_2024	-	-	x64
App	microsoft	office_2024	-	-	x86
App	microsoft	office_2024	-	macos	-
App	microsoft	office_online_server	-	-	-

Explore more

Back to dashboard microsoft CVEs 365_apps vulnerabilities

What researchers are saying

CVE-2026-47642

くろん｜情シスAIラボ[verified]@josys_AI_laboDisclosure

Microsoft Office Excel has a UAF vulnerability (CVE-2026-47642) with a CVSS v3 score of 7.8, affecting a broad range of Office releases and enabling local code execution via crafted Excel files; affected organizations should inventory installations promptly.

Windows Forum[verified]@windowsforumPatch

The post alerts users to a remote code execution flaw in Excel 7.8 (CVE‑2026‑47642) and urges them to apply the available patch, noting that attackers can exploit it simply by opening a malicious workbook.

Haifei Li@HaifeiLiPatch

The author announces the July Patch Tuesday updates that remediate two Office RCE vulnerabilities, providing Microsoft update links, with no PoC or active exploitation reported.