CVE-2023-36041: Microsoft Excel use-after-free enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.8 and high EPSS with an exploit reference indicate a serious, likely exploitable flaw, though it requires user interaction and is not in KEV.

What it is

CVE-2023-36041 is a use-after-free (CWE-416) vulnerability in Microsoft Excel and related Office products. A crafted file can corrupt memory and execute code in the context of the user. It matters because Excel is widely deployed and the flaw is trivially triggered by opening a malicious document.

Impact

An attacker who convinces a user to open a specially crafted Excel file can execute arbitrary code with the privileges of that user. This can lead to full compromise of the user's session and data.

Attack surface

The vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), meaning the attacker must deliver a malicious file that the victim opens in Excel. No authentication is needed on the target; the attack relies on social engineering to get the file opened.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.56727 (99th percentile), indicating a high likelihood of exploitation activity. A third-party advisory (Talos) is tagged as an exploit reference, suggesting public technical details or proof-of-concept exist.

What to do

• Apply the Microsoft security update for CVE-2023-36041 immediately on all affected Office and Excel installations.
• Enable Microsoft Defender Application Guard or Protected View for Office documents from untrusted sources.
• Block or restrict execution of Excel macros and untrusted file types via Group Policy or Attack Surface Reduction rules.
• Educate users not to open unexpected Excel attachments or links, and enforce email filtering for suspicious documents.
• Consider disabling Excel ActiveX and legacy features where not required.

Detection

• Monitor for Excel processes (EXCEL.EXE) spawning child processes such as cmd.exe, powershell.exe, or wscript.exe.
• Hunt for unusual file writes or registry modifications originating from Excel, especially in user-writable directories.
• Use endpoint detection to flag memory corruption indicators or crashes in Excel followed by suspicious network connections.
• Review email gateway logs for Excel attachments with embedded objects or macros from external senders.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.