KB5002849 — Security Update for Microsoft Excel 2016

Overview

KB5002849 is a critical security update for Microsoft Excel 2016 released on March 10, 2026. This update addresses multiple high-severity vulnerabilities that could allow remote code execution, memory corruption, and information disclosure attacks. The update applies to both 32-bit and 64-bit editions of Excel 2016 and is delivered through Microsoft's standard update channels.

Security Vulnerabilities Addressed

This update resolves four critical security vulnerabilities identified in Microsoft Excel 2016:

CVE-2026-0847: Remote Code Execution in File Parsing

A critical buffer overflow vulnerability in Excel's XLSX file format parser could allow attackers to execute arbitrary code by convincing users to open specially crafted Excel files. The vulnerability affects the worksheet relationship parsing component and could be exploited through email attachments or malicious downloads.

CVE-2026-0848: Memory Corruption in Pivot Tables

A use-after-free vulnerability in Excel's pivot table calculation engine could lead to memory corruption and potential code execution. This vulnerability is triggered when processing pivot tables with complex data source references and calculated fields.

CVE-2026-0849: Information Disclosure in Formula Evaluation

An information disclosure vulnerability allows attackers to read beyond allocated memory boundaries through specially crafted formulas, potentially exposing sensitive data from system memory or other applications.

CVE-2026-0850: VBA Macro Security Bypass

A security bypass vulnerability in protected view allows execution of unsigned VBA macros under certain conditions, circumventing Excel's macro security protections.

Affected Systems

This security update applies to the following Microsoft Excel 2016 editions:

Systems running Excel 2016 as part of Office 365 ProPlus or Microsoft 365 Apps for Enterprise are also affected and will receive updates through their respective update channels.

Technical Implementation Details

File Format Security Enhancements

The update implements comprehensive input validation for Excel file formats, including:

• Enhanced bounds checking for worksheet metadata parsing
• Improved validation of cell references and formula syntax
• Strengthened protection against malformed file structures
• Additional security checks for external data connections

Memory Management Improvements

Memory handling enhancements include:

• Proper reference counting for pivot table cache objects
• Improved cleanup of temporary calculation objects
• Enhanced validation of memory access operations
• Strengthened protection against use-after-free conditions

Macro Security Reinforcement

VBA macro security improvements encompass:

• Stricter validation of macro signatures and certificates
• Enhanced sandboxing for protected view documents
• Improved detection of macro bypass attempts
• Additional logging for macro security events

Deployment Considerations

Enterprise Environments

Organizations should prioritize deployment of this update due to the critical nature of the vulnerabilities addressed. Consider the following deployment strategies:

• Phased Rollout: Deploy to test groups first to validate compatibility with business-critical Excel files and add-ins
• User Communication: Inform users about potential changes in macro security behavior and file compatibility warnings
• Add-in Testing: Verify compatibility of third-party Excel add-ins before widespread deployment

Home and Small Business Users

Individual users should install this update immediately through Windows Update or Office Update. The update will install automatically for users with automatic updates enabled.

Verification and Validation

After installing KB5002849, verify the update by checking the Excel version:

1. Open Microsoft Excel 2016
2. Navigate to File > Account
3. Click About Excel
4. Verify the version shows 16.0.5435.1000 or later

Additionally, you can verify the update installation using PowerShell:

Get-HotFix -Id KB5002849

Security Best Practices

While this update addresses critical vulnerabilities, users should continue following security best practices:

• Avoid opening Excel files from untrusted sources
• Keep macro security settings at recommended levels
• Regularly update Excel and other Office applications
• Use antivirus software with real-time protection
• Enable protected view for files from external sources