CVE-2023-32029: Microsoft Excel out-of-bounds read leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.8 with high confidentiality, integrity and availability impact plus a 99th percentile EPSS score, though exploitation requires the user to open a file and no KEV listing exists.

What it is

CVE-2023-32029 is a remote code execution vulnerability in Microsoft Excel and related Office products, rooted in an out-of-bounds read (CWE-125). The record gives only a one-line description, so the exact parsing path and trigger file format are not specified. It matters because successful exploitation yields code execution in the context of the opening user.

Impact

An attacker who gets a crafted file opened gains code execution with the privileges of the current user, with high impact to confidentiality, integrity and availability per the CVSS vector. No privilege escalation beyond the user's own rights is described.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), meaning the victim must open a malicious document or file. It is not remotely reachable without that user action, and no authentication is needed.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is 0.53513 (99th percentile), indicating high predicted exploitation activity. The only reference tags are Patch and Vendor Advisory, so no public exploit or in-the-wild confirmation is stated in this record.

What to do

• Apply the Microsoft update for CVE-2023-32029 from the MSRC update guide as the first action.
• Enable Microsoft Defender or equivalent attack surface reduction rules that block Office child processes and executable content from Office files.
• Configure Office to open files from untrusted locations in Protected View and disable macros where not required.
• Restrict email and web download paths for Office documents and block legacy or unexpected file types at the gateway.
• Keep Office and 365 Apps on a current update channel so future fixes are applied automatically.

Detection

• Monitor for Excel or Office processes spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Alert on Office applications loading unusual DLLs or writing executables to temp or user profile directories.
• Hunt for documents matching known exploit indicators from the Talos TALOS-2023-1730 report once its details are reviewed.
• Track endpoint events where Excel crashes or reads malformed files shortly before suspicious process creation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.