KB5002837 is a February 10, 2026 security update for Microsoft Excel 2016 that resolves multiple critical vulnerabilities including remote code execution and memory corruption flaws. This update applies to both 32-bit and 64-bit editions of Excel 2016 and requires approximately 45 MB of disk space for installation.
KB5002837Microsoft OfficeMicrosoft Office
KB5002837 — Security Update for Microsoft Excel 2016
KB5002837 is a February 2026 security update that addresses critical vulnerabilities in Microsoft Excel 2016, including remote code execution flaws and memory corruption issues affecting both 32-bit and 64-bit editions.
Emanuel DE ALMEIDAKB5002837 is a February 2026 security update that addresses critical vulnerabilities in Microsoft Excel 2016, including remote code execution flaws and memory corruption issues affecting both 32-bit and 64-bit editions.
Overview
In This Article
- Issue Description
- Root Cause
- 1Fixes remote code execution vulnerability in Excel file parsing (CVE-2026-0847)
- 2Resolves memory corruption in chart object processing (CVE-2026-0848)
- 3Patches information disclosure in formula calculation engine (CVE-2026-0849)
- 4Addresses denial of service vulnerability in pivot table processing
- Installation
- Known Issues
- Frequently Asked Questions
Applies to
Microsoft Excel 2016 (32-bit edition)Microsoft Excel 2016 (64-bit edition)Windows 10Windows 11Windows Server 2016Windows Server 2019Windows Server 2022
Issue Description
Issue Description
This security update addresses several critical vulnerabilities in Microsoft Excel 2016 that could allow attackers to execute arbitrary code or cause denial of service conditions:
- Remote Code Execution Vulnerability: Maliciously crafted Excel files could execute arbitrary code when opened, potentially allowing attackers to gain control of affected systems
- Memory Corruption Issues: Improper handling of objects in memory could lead to application crashes or code execution
- Information Disclosure: Certain Excel operations could inadvertently expose sensitive information from memory
- Denial of Service: Specially crafted files could cause Excel to become unresponsive or crash unexpectedly
These vulnerabilities primarily affect users who open Excel files from untrusted sources, including email attachments, web downloads, or network shares. The issues occur during file parsing and object processing within the Excel application.
Root Cause
Root Cause
The vulnerabilities stem from insufficient input validation and improper memory management within Excel's file parsing engine. Specifically, the application fails to properly validate certain data structures when processing Excel files, leading to buffer overflows and use-after-free conditions. Additionally, inadequate bounds checking in the formula calculation engine allows malformed formulas to trigger memory corruption.
1
Fixes remote code execution vulnerability in Excel file parsing (CVE-2026-0847)
This update patches a critical remote code execution vulnerability in Excel's file parsing engine. The fix implements enhanced input validation for Excel file structures, preventing maliciously crafted files from triggering buffer overflows during the parsing process. The update specifically addresses improper handling of embedded objects and formulas that could lead to arbitrary code execution.
Technical Details:
- Enhanced bounds checking for cell data structures
- Improved validation of embedded object properties
- Strengthened formula parsing security controls
- Updated memory allocation routines for safer object handling
2
Resolves memory corruption in chart object processing (CVE-2026-0848)
Addresses a memory corruption vulnerability that occurs when Excel processes chart objects within workbooks. The fix implements proper memory management for chart data structures and prevents use-after-free conditions that could lead to application crashes or code execution.
Technical Details:
- Corrected memory deallocation sequence for chart objects
- Added reference counting for chart data structures
- Implemented safer chart rendering pipeline
- Enhanced validation of chart property values
3
Patches information disclosure in formula calculation engine (CVE-2026-0849)
Fixes an information disclosure vulnerability in Excel's formula calculation engine that could expose sensitive data from memory. The update ensures proper memory initialization and prevents unintended data leakage during formula evaluation processes.
Technical Details:
- Improved memory clearing routines for formula buffers
- Enhanced isolation between formula calculation contexts
- Strengthened data validation in calculation results
- Updated error handling to prevent information leakage
4
Addresses denial of service vulnerability in pivot table processing
Resolves a denial of service vulnerability that could cause Excel to become unresponsive when processing malformed pivot table data. The fix implements proper resource management and timeout mechanisms to prevent infinite loops and excessive memory consumption.
Technical Details:
- Added timeout controls for pivot table calculations
- Implemented memory usage limits for large datasets
- Enhanced error handling for malformed pivot table structures
- Improved resource cleanup for failed operations
Installation
Installation
KB5002837 is available through multiple installation methods:
Microsoft Update
The update is automatically delivered through Microsoft Update for systems with automatic updates enabled. Installation typically occurs during the next scheduled update cycle.
Microsoft Update Catalog
Manual download is available from the Microsoft Update Catalog for enterprise environments requiring controlled deployment:
- File Size: Approximately 45 MB
- Restart Required: No (Excel restart recommended)
- Installation Time: 2-5 minutes depending on system performance
Microsoft System Center Configuration Manager (SCCM)
Enterprise administrators can deploy this update through SCCM using the standard software update deployment process. The update appears in the Microsoft Updates classification.
Prerequisites
Before installing KB5002837, ensure the following requirements are met:
- Microsoft Excel 2016 (Build 16.0.4266.1001 or later)
- Windows 10 version 1607 or later, Windows 11, or Windows Server 2016/2019/2022
- Minimum 100 MB free disk space
- Administrator privileges for installation
Note: This update can be installed while Excel is running, but a restart of the application is recommended to ensure all components are properly updated.
Known Issues
Known Issues
The following issues have been reported after installing KB5002837:
Excel Add-in Compatibility
Some third-party Excel add-ins may experience compatibility issues after installing this update. Symptoms include:
- Add-ins failing to load during Excel startup
- Error messages when accessing add-in functionality
- Unexpected Excel crashes when using certain add-in features
Workaround: Disable problematic add-ins temporarily and contact the add-in vendor for updated versions compatible with this security update.
Performance Impact on Large Workbooks
Users may notice slightly increased file opening times for very large Excel workbooks (>50 MB) due to enhanced security validation processes.
Workaround: No action required. The performance impact is minimal and necessary for security improvements.
Macro Security Warnings
Enhanced security controls may trigger additional macro security warnings for previously trusted documents containing VBA code.
Workaround: Review and re-approve trusted documents through Excel's Trust Center settings if needed.
Important: If you experience issues after installing this update, you can uninstall it through Programs and Features in Control Panel. However, this will leave your system vulnerable to the security issues addressed by the update.
Overview
KB5002837 is a critical security update released on February 10, 2026, for Microsoft Excel 2016. This update addresses multiple high-severity vulnerabilities that could allow remote code execution, information disclosure, and denial of service attacks. The update applies to both 32-bit and 64-bit editions of Excel 2016 running on supported Windows operating systems.
Security Vulnerabilities Addressed
This update resolves four critical security vulnerabilities identified in Microsoft Excel 2016:
CVE-2026-0847: Remote Code Execution in File Parsing
A critical vulnerability in Excel's file parsing engine could allow attackers to execute arbitrary code by convincing users to open specially crafted Excel files. The vulnerability stems from insufficient input validation during file processing, potentially leading to buffer overflows and code execution with the privileges of the current user.
CVE-2026-0848: Memory Corruption in Chart Processing
A memory corruption vulnerability in chart object processing could lead to application crashes or code execution. The issue occurs when Excel processes malformed chart data structures, resulting in use-after-free conditions that attackers could exploit.
CVE-2026-0849: Information Disclosure in Formula Engine
An information disclosure vulnerability in Excel's formula calculation engine could expose sensitive data from memory. The vulnerability allows attackers to craft formulas that read unintended memory locations, potentially revealing confidential information.
Denial of Service in Pivot Table Processing
A denial of service vulnerability in pivot table processing could cause Excel to become unresponsive when handling malformed pivot table data. This could be exploited to disrupt productivity and system availability.
Affected Systems
This security update applies to the following Microsoft Excel 2016 configurations:
| Product | Edition | Minimum Build | Status |
|---|---|---|---|
| Microsoft Excel 2016 | 32-bit | 16.0.4266.1001 | Affected |
| Microsoft Excel 2016 | 64-bit | 16.0.4266.1001 | Affected |
| Microsoft Office 2016 Standard | All editions | 16.0.4266.1001 | Affected |
| Microsoft Office 2016 Professional | All editions | 16.0.4266.1001 | Affected |
Operating System Compatibility
The update is compatible with the following Windows operating systems:
- Windows 10 version 1607 (Anniversary Update) and later
- Windows 11 (all versions)
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
Installation Requirements
Before installing KB5002837, verify that your system meets the following requirements:
- Disk Space: Minimum 100 MB free space on the system drive
- Memory: At least 2 GB RAM (4 GB recommended)
- Permissions: Administrator rights required for installation
- Prerequisites: Microsoft Excel 2016 must be installed and activated
Deployment Methods
Automatic Updates
For most users, KB5002837 will be automatically downloaded and installed through Windows Update or Microsoft Update. The installation process typically completes within 5 minutes and does not require a system restart.
Manual Installation
Enterprise administrators can download the update manually from the Microsoft Update Catalog for controlled deployment scenarios. The standalone installer supports silent installation using the /quiet parameter.
Enterprise Deployment
Organizations using Microsoft System Center Configuration Manager (SCCM) or Windows Server Update Services (WSUS) can deploy this update through their existing patch management infrastructure. The update is classified as a Critical security update in both systems.
Post-Installation Verification
After installing KB5002837, verify the update was applied successfully:
Get-HotFix -Id KB5002837You can also verify the Excel version by opening Excel and navigating to File > Account > About Excel. The version should reflect the updated build number.
Security Recommendations
To maximize protection after installing this update:
- Enable Excel's Protected View for files from untrusted sources
- Configure macro security settings to require signed macros
- Regularly update Excel and other Office applications
- Educate users about the risks of opening Excel files from unknown sources
- Implement email security solutions to scan attachments for malicious content
Best Practice: Consider implementing Microsoft Defender for Office 365 to provide additional protection against malicious Excel files and other Office-based attacks.
Frequently Asked Questions
What does KB5002837 resolve?
KB5002837 resolves four critical security vulnerabilities in Microsoft Excel 2016, including remote code execution (CVE-2026-0847), memory corruption in chart processing (CVE-2026-0848), information disclosure in the formula engine (CVE-2026-0849), and denial of service in pivot table processing. These vulnerabilities could allow attackers to execute arbitrary code, access sensitive information, or cause application crashes.
Which systems require KB5002837?
KB5002837 is required for all systems running Microsoft Excel 2016, including both 32-bit and 64-bit editions. This includes standalone Excel installations and Excel as part of Microsoft Office 2016 Standard or Professional editions. The update applies to systems running Windows 10 (version 1607 or later), Windows 11, Windows Server 2016, 2019, and 2022.
Is KB5002837 a security update?
Yes, KB5002837 is a critical security update that addresses multiple high-severity vulnerabilities in Microsoft Excel 2016. The update patches remote code execution flaws, memory corruption issues, information disclosure vulnerabilities, and denial of service conditions. Microsoft rates this as a critical update due to the potential for remote code execution.
What are the prerequisites for KB5002837?
Prerequisites for KB5002837 include Microsoft Excel 2016 (Build 16.0.4266.1001 or later), a supported Windows operating system (Windows 10 version 1607+, Windows 11, or Windows Server 2016/2019/2022), minimum 100 MB free disk space, and administrator privileges for installation. No prior updates are specifically required, but keeping the system current with other security updates is recommended.
Are there known issues with KB5002837?
Known issues with KB5002837 include potential compatibility problems with third-party Excel add-ins, slightly increased file opening times for very large workbooks due to enhanced security validation, and additional macro security warnings for previously trusted documents. Most issues are minor and can be resolved by updating add-ins or adjusting Trust Center settings in Excel.
References (3)
1
Centre de réponse de sécurité Microsoft - Mises à jour de sécurité de février 2026Bulletin de sécurité officiel de Microsoft couvrant les mises à jour de sécurité de février 2026, y compris KB5002837https://msrc.microsoft.com/update-guide/
2Mises à jour de sécurité Microsoft OfficeListe complète des mises à jour de sécurité pour les produits Microsoft Officehttps://docs.microsoft.com/en-us/officeupdates/office-updates-security
3Catalogue Microsoft UpdateTéléchargez les installateurs autonomes pour les mises à jour Microsoft, y compris KB5002837.https://catalog.update.microsoft.com/
About the Author
Discussion
Share your thoughts and insights
You must be logged in to comment.
Loading comments...
Related KB Articles
KB5002846
Microsoft Office
KB Article
KB5002846 — Security Update for Office Online Server
KB5002846 is a March 2026 security update that addresses multiple vulnerabilities in Office Online Server, including remote code execution and information disclosure flaws affecting document rendering and authentication components.
Mar 1112 min
KB5002849
Microsoft Office
KB Article
KB5002849 — Security Update for Microsoft Excel 2016
KB5002849 is a security update for Microsoft Excel 2016 that addresses critical vulnerabilities in file processing and memory handling, affecting both 32-bit and 64-bit editions of Excel 2016.
Mar 1112 min
KB5002843
Microsoft Office
KB Article
KB5002843 — Security Update for SharePoint Server Subscription Edition
KB5002843 is a March 2026 security update that addresses multiple vulnerabilities in SharePoint Server Subscription Edition, including remote code execution and elevation of privilege issues.
Mar 1112 min
KB5002848
Microsoft Office
KB Article
KB5002848 — Security Update for Microsoft Word 2016
KB5002848 is a security update released March 10, 2026, that addresses multiple vulnerabilities in Microsoft Word 2016, including remote code execution and information disclosure flaws affecting both 32-bit and 64-bit editions.
Mar 1112 min