CIVN-2026-0020: Multiple Remote Code Execution Vulnerabilities in Microsoft Excel
Advisory ID: CIVN-2026-0020 | Severity: HIGH (CVSS 7.8) | Published: January 14, 2026
On January 14, 2026, CERT-In (Indian Computer Emergency Response Team) published advisory CIVN-2026-0020 warning organizations about multiple critical Remote Code Execution (RCE) vulnerabilities in Microsoft Excel. These flaws, tracked as CVE-2026-20955 and CVE-2026-20957, allow attackers to execute arbitrary code on victim systems by tricking users into opening malicious Excel files.
These vulnerabilities were addressed as part of Microsoft's January 2026 Patch Tuesday, which fixed 114 vulnerabilities including 8 critical flaws and 3 zero-days. Organizations using Microsoft Excel should apply patches immediately.
Vulnerability Details
| Attribute | CVE-2026-20955 | CVE-2026-20957 |
|---|---|---|
| Vulnerability Type | Untrusted Pointer Dereference | Integer Underflow → Heap Overflow |
| CWE | CWE-822 | CWE-191, CWE-122 |
| CVSS 3.1 Score | 7.8 (HIGH) | 7.8 (HIGH) |
| Attack Vector | Local (via malicious file) | Local (via malicious file) |
| User Interaction | Required (open file) | Required (open file) |
| Exploitation Status | Not exploited in wild | Not exploited in wild |
| Public PoC | None available | None available |
CVE-2026-20955: Untrusted Pointer Dereference
This vulnerability exists due to an untrusted pointer dereference weakness (CWE-822) in Microsoft Office Excel. When Excel processes a malformed file, it incorrectly handles pointer values from untrusted sources, allowing attackers to read/write arbitrary memory locations and execute code.
-
CVE ID: CVE-2026-20955
-
CWE: CWE-822 (Untrusted Pointer Dereference)
-
CVSS 3.1 Score: 7.8 (HIGH)
-
CVSS Vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
-
Exploitation Likelihood: Less Likely (per Microsoft)
-
Publicly Disclosed: No
-
Exploited in Wild: No
CVE-2026-20957: Integer Underflow
This vulnerability is caused by an integer underflow (CWE-191) that leads to a heap-based buffer overflow (CWE-122). When a subtraction operation produces a value below the minimum integer, it wraps around, causing incorrect buffer size calculations and memory corruption.
-
CVE ID: CVE-2026-20957
-
CWE: CWE-191 (Integer Underflow), CWE-122 (Heap Overflow)
-
CVSS 3.1 Score: 7.8 (HIGH)
-
CVSS Vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Scenario
Exploitation of these vulnerabilities follows a typical document-based attack pattern:
Attack Flow Infographic
Potential Impact:
Affected Products
The following Microsoft Office products are affected:
| Product | Platform | Editions |
|---|---|---|
| Microsoft 365 Apps for Enterprise | Windows | x64 and x86 |
| Microsoft Office 2019 | Windows | x64 and x86 |
| Microsoft Office LTSC 2021 | Windows, macOS | All |
| Microsoft Office LTSC 2024 | Windows, macOS | All |
| Microsoft Excel 2016 | Windows | All (MSI-based) |
| Microsoft Office Online Server | Server | Prior to 16.0.10417.20083 |
Patched Versions
| Channel / Edition | Version | Build |
|---|---|---|
| Microsoft 365 (Current Channel) | 2512 | 19530.20144 |
| Monthly Enterprise Channel | 2511 | 19426.20260 |
| Semi-Annual Enterprise Channel | 2508 | 19127.20484 |
| Office LTSC 2024 (Volume) | 2408 | 17932.20638 |
| Office LTSC 2021 (Volume) | 2108 | 14334.20468 |
| Office 2019 (Volume) | 1808 | 10417.20083 |
For Office 2016 MSI installations, apply KB articles: KB5002831, KB5002826, KB5002829
Industry Assessment
"While we are still unaware of any exploitation of these bugs, they keep adding up. It's only a matter of time until threat actors find a way to use these types of bugs in their exploits." — Zero Day Initiative (ZDI)
Qualys identifies both vulnerabilities as critical RCE flaws requiring immediate patching, emphasizing the high organizational risk due to widespread Excel deployment. January 2026 saw an unusually high number of Office/Excel vulnerabilities, indicating these products remain high-value targets for attackers.
Mitigation and Remediation
Primary Action: Apply Microsoft security updates immediately from the official MSRC portal.
Immediate Steps
-
Apply Security Updates
Download patches from CVE-2026-20955 and CVE-2026-20957
-
Enable Protected View
File → Options → Trust Center → Trust Center Settings → Protected View → Enable all options
-
User Awareness
Warn users not to open Excel files from untrusted sources
Defense in Depth
-
Email Security: Block or quarantine suspicious Excel attachments
-
Endpoint Protection: Ensure EDR/AV signatures are updated
-
Network: Monitor for anomalous file downloads
-
User Training: Reinforce phishing awareness
-
Application Control: Consider restricting macro execution
January 2026 Patch Tuesday Context
These vulnerabilities were patched as part of a larger update addressing 114 vulnerabilities, including 8 critical and 3 zero-days. Other notable Office vulnerabilities in the same release:
-
CVE-2026-20944: Microsoft Word - RCE (Preview Pane vector)
-
CVE-2026-20946: Microsoft Excel - RCE
-
CVE-2026-20950: Microsoft Excel - RCE
-
CVE-2026-20952: Microsoft Excel - RCE
Key Takeaways
-
Patch immediately — Updates are available from Microsoft
-
User interaction required — Victim must open the malicious file
-
Preview Pane is safe — Unlike some Word CVEs, not a vector here
-
No public PoC — But this may change; patch before exploitation becomes active
Conclusion
CIVN-2026-0020 highlights two serious memory corruption vulnerabilities in Microsoft Excel that could allow remote code execution. While no active exploitation has been confirmed and Microsoft rates exploitation as "less likely," the high severity rating (CVSS 7.8) and widespread deployment of Microsoft Excel make these vulnerabilities significant risks. Organizations must act decisively: apply patches immediately, enable Protected View, and ensure users are aware of phishing risks involving Excel attachments.
References
Official Sources:
CERT-In Advisory CIVN-2026-0020
Technical References:
CWE-822: Untrusted Pointer Dereference
CWE-122: Heap-based Buffer Overflow
Third-Party Analysis:
