Troubleshooting & Fixing the Microsoft Excel KB5002914 Silent Paste Bug

Published: September 2026

Category: Enterprise IT / Desktop Engineering / System Administration

Applies To: Microsoft Excel 2016, 2019, 2021, 2024, LTSC (MSI & Click-to-Run)

Abstract

Following the release of Microsoft's September Patch Tuesday security update, IT administrators and end-users reported critical failures in core spreadsheet features across Microsoft Excel installations. The security patch KB5002914—intended to mitigate remote code execution (RCE) vulnerabilities—introduced a severe regression breaking Copy/Paste (Ctrl+C / Ctrl+V), AutoFill, and formula dragging.

This post provides a deep technical breakdown of the issue, identifies affected builds, outlines safety precautions, and delivers step-by-step resolution scripts for system administrators and end-users.

1. Executive Summary & Problem Overview

On September 8, 2026, Microsoft deployed patch KB5002914 for Excel 2016 (along with parallel channel releases for Excel 2019, 2021, and 2024). Shortly after deployment, user communities and enterprise helpdesks reported that basic clipboard and fill operations had stopped functioning without displaying any error dialogs.

Microsoft formally acknowledged the regression in the KB5002914 release notes as a Known Issue:

"In Microsoft Excel 2024, 2021, 2019, and 2016, the paste operation might fail silently. Although users try to paste content, the source remains selected and the destination is unmodified. When this issue occurs, users receive no indication of the failure, such as a beep or error message."

Key Metrics

• Patch ID: KB5002914 (MSI variant) / Associated C2R Build updates (e.g., Build 14334.20906, 17932.20976, 10417.20207).

• Release Date: September 8, 2026.

• Failure Mode: Silent failure (zero error codes or UI alerts).

• Impact Level: High (blocks standard daily workflow for data entry and financial modeling).

2. Technical Breakdown & Symptoms

Symptoms

1. Silent Paste Failure: Pressing Ctrl+C followed by Ctrl+V (or using the ribbon icon) results in no action. The source cell retains its animated "marching ants" marquee border, but the target cell remains unchanged.

2. Broken AutoFill & Series Fill: Clicking and dragging the bottom-right corner handle (fill handle) fails to populate adjacent cells or generate number series.

3. Formula Dragging Dropped: Dragging a formula across a range fails to copy the formula logic or update relative references.

4. VBA & Macro Disruption: Certain macro operations relying on Range.Copy or Selection.PasteSpecial crash silently or trigger memory access violation exceptions (0xc0000005).

Root Cause Analysis (RCA)

Preliminary analysis indicates that KB5002914 modified internal pointer validation and memory management within EXCEL.EXE (specifically addressing RCE buffer overflow vulnerabilities).

This modification accidentally interfered with Excel's inter-process and intra-process OLE/COM Clipboard pipeline. When a paste command is issued, Excel's internal clip-handler validates object signatures prior to committing the memory write. Due to the patch logic, valid internal cell references fail this security state check, causing the application to discard the commit operation silently without raising an unhandled exception.

3. Scope of Impact

The table below illustrates the scope across deployment channels:

4. Fix Solutions & Remediation Workflows

Solution A: Remediation for MSI-Based Installations (Excel 2016)

For legacy Windows Installer (MSI) environments, KB5002914 exists as a standalone patch package and can be removed independently.

Method 1: Using Command Prompt (Administrative)

Run the following command via elevated CMD to silent-uninstall the specific hotfix package:

wusa.exe /uninstall /kb:5002914 /quiet /norestart

Method 2: Using the Office Maintenance Utility (Oarpmany)

Alternatively, leverage Microsoft's Office installer cleanup utility (Oarpmany.exe):

& "C:\Program Files\Common Files\Microsoft Shared\OFFICE16\Oarpmany.exe" /removereleaseinpatch "{90160000-0012-0000-1000-0000000FF1CE}" "{27882596-A8ED-4382-9C71-6CD2DD19F732}" "1036" "0"

Solution B: Remediation for Click-to-Run (C2R) Installations (Office 2019/2021/2024/LTSC)

Click-to-Run installations do not permit single KB package uninstalls. You must roll back the Office suite to a build prior to the September 8, 2026 update.

Step 1: Execute Build Rollback

Open Command Prompt as Administrator and navigate to the C2R client engine directory:

cd "C:\Program Files\Common Files\microsoft shared\ClickToRun"

Execute the update engine with the pre-patch target version (e.g., rolling back to August 2026 build 16.0.14334.20848 for Office 2021 LTSC):

officec2rclient.exe /update user updatetoversion=16.0.14334.20848

Step 2: Temporarily Disable Automatic Updates

To prevent Office from automatically re-applying the broken patch overnight:

1. Open Excel.

2. Go to File > Account.

3. Under Update Options, click Disable Updates.

(Note for IT Administrators: You can enforce update pausing across the domain using the Group Policy Object under Administrative Templates > Microsoft Office 2016 (or 2021) > Updates > Enable Automatic Updates set to Disabled).

Solution C: Automated Enterprise Recovery Script (PowerShell)

System Administrators deploying fixes via SCCM, Intune, or RMM tools can deploy this PowerShell script to automate detection and remediation.

<#
.SYNOPSIS
    Automated Remediation for Excel Copy/Paste KB5002914 Patch Issue.
.DESCRIPTION
    Detects Office installation type (MSI vs C2R) and performs target rollback/removal.
#>

$ErrorActionPreference = "Stop"

function Uninstall-MSIPatch {
    Write-Host "[+] Detecting MSI Installation of KB5002914..." -ForegroundColor Cyan
    $KBSearch = Get-HotFix | Where-Object { $_.HotFixID -eq "KB5002914" }
    
    if ($KBSearch) {
        Write-Host "[!] Found KB5002914. Executing uninstallation..." -ForegroundColor Yellow
        Start-Process -FilePath "wusa.exe" -ArgumentList "/uninstall /kb:5002914 /quiet /norestart" -Wait
        Write-Host "[SUCCESS] KB5002914 removed successfully." -ForegroundColor Green
    } else {
        Write-Host "[-] KB5002914 is not installed via Windows Update." -ForegroundColor Gray
    }
}

function Rollback-C2RBuild {
    Param([string]$TargetVersion = "16.0.14334.20848")
    
    Write-Host "[+] Rolling back Click-to-Run build to $TargetVersion..." -ForegroundColor Cyan
    $C2RPath = "$env:CommonProgramFiles\microsoft shared\ClickToRun\officec2rclient.exe"
    
    if (Test-Path $C2RPath) {
        $Args = "/update user displaylevel=false updatetoversion=$TargetVersion"
        Start-Process -FilePath $C2RPath -ArgumentList $Args -Wait
        Write-Host "[SUCCESS] Click-to-Run rollback triggered." -ForegroundColor Green
    } else {
        Write-Host "[ERROR] Office C2R Client executable not found!" -ForegroundColor Red
    }
}

# Main Execution Flow
try {
    Uninstall-MSIPatch
    
    # Verify C2R Registry Path
    $C2RReg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -ErrorAction SilentlyContinue
    if ($null -ne $C2RReg) {
        Rollback-C2RBuild -TargetVersion "16.0.14334.20848"
    }
} catch {
    Write-Error "Remediation failed: $_"
}

5. Non-Destructive User Workarounds

If security policy strictly prohibits rolling back security updates, end-users can utilize these alternative operational workarounds:

1. Use "Paste Values" Context Menu:

   • Copy cells normally (Ctrl+C).

   • Right-click destination cell $\rightarrow$ Select Paste Values ($V$) or Paste Special.

   • Note: This bypasses the OLE data-object pipeline and inserts plain text/values (formulas and formatting will be lost).

2. Formula Fill via Shortcut Key:

   • Instead of dragging the fill handle, select the target range including the original top cell.

   • Press Ctrl+D (Fill Down) or Ctrl+R (Fill Right).

3. Office on the Web:

   • Open the file in Excel for the Web via OneDrive or SharePoint. Cloud-rendered instances are unimpacted by desktop client patches.

6. Security Considerations & Best Practices

⚠️ Warning on DLL Replacement Hack:

A workaround circulating on technical forums suggests keeping KB5002914 installed while replacing the patched EXCEL.EXE binary with an older executable version. This is strongly discouraged. Swapping core binaries creates an unvalidated "hybrid" state, introduces app instability, breaks application code signing integrity, and nullifies enterprise compliance reporting.

Security Trade-Off

KB5002914 addresses 29 individual vulnerabilities, including critical Remote Code Execution flaws in Excel's file-parsing library.

• If your workforce regularly opens external .xlsx or .xlsm email attachments from untrusted sources, prioritize using temporary workarounds (Paste Special) over rolling back the patch.

• If a rollback is mandatory for operational continuity, ensure strict Attack Surface Reduction (ASR) rules and perimeter email attachment sandboxing are active until Microsoft publishes the revised out-of-band fix.

Summary Verification Checklist

After applying the remediation fix, verify stability using the following tests:

• [ ] Select a cell with a formula $\rightarrow$ Copy (Ctrl+C) $\rightarrow$ Paste (Ctrl+V) into a new sheet.

• [ ] Type 1 and 2 into consecutive rows $\rightarrow$ Select both $\rightarrow$ Drag fill handle down 10 rows (Verify auto-increment sequence).

• [ ] Confirm Excel build number under File > Account > About Excel.