Micropatches released for Microsoft Excel Remote Code Execution Vulnerability (CVE-2026-40362)
July 2026 Windows Updates brought a patch for CVE-2026-40362, a remote code execution vulnerability in Microsoft Excel that allows a remote attacker to execute arbitrary code on user's computer as soon as they open a malicious Excel document.
This vulnerability was found by security researchers Jeongmin Choi with S2W and Haein Lee with KAIST Hacking Lab; both reported this finding to Microsoft.
Jeongmin subsequently published a detailed article that allowed us to reproduce the issue and create patches for legacy Microsoft Office users.
The Vulnerability
The vulnerability is a rare case of "buffer underflow," whereby the flawed code is going backward through an array to locate the element before the last populated one; and when the array is empty, the code locates the element before the start of the arrray, i.e., the "minus first element." This is of course not a part of the array's memory space, so the code overwrites some data located before the array with attacker-controlled content.
In general, such overwrite can be used to implement arbitrary code execution.
Microsoft's Patch
Microsoft fixed the issue by adding a check if the array is currently empty, and not locating the element before the last populated one.
Our Patch
Our patch is logically identical to Microsoft's.
Micropatch Availability
Micropatches were written for the following security-adopted Office versions:
Microsoft Excel 2019 Click-To-Run - updated to October 2025
Microsoft Excel 2016 Click-To-Run- updated to October 2025
Microsoft Excel 2013 - fully updated
Microsoft Excel 2010 - fully updated
Micropatches have already been distributed to, and applied on, all affected online computers with 0patch Agent in PRO or Enterprise accounts (unless Enterprise group settings prevented that).
New vulnerabilities like these are discovered regularly, and attackers can eventually learn about and exploit them. If you're using Windows that aren't receiving official security updates anymore, 0patch will help prevent these vulnerabilities from being exploited on your computers - and you won't even have to know or care about these things.
We'd like to thank Jeongmin Choi with S2W for sharing their analysis, which allowed us to create patches for Office versions that are no longer receiving official updates from Microsoft.
If you're new to 0patch, create a free account in 0patch Central, start a free trial, then install and register 0patch Agent. Everything else will happen automatically. No computer reboot will be needed.
Did you know 0patch security-adopted Windows 10 and Office 2016 and 2019 when they went out of support in October 2025, allowing you to keep using them for at least 3 more years (5 years for Windows 10)? Read more about it here and here.
Note that we will soon security-adopt the following products:
Windows 10 22H2 with Extended Security Updates year 1: October 2026
Windows Server 2012 with Extended Security Updates year 3: October 2026
Windows Server 2012 R2 with Extended Security Updates year 3: October 2026
Microsoft Office 2021: October 2026 - Read more about it here
Windows 11 23H2 (E): November 2026
Windows Server 2016: January 2027
To learn more about 0patch, please visit our Help Center.