EUVD-2026-29642
GHSA-m94j-ww5w-723q
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open with user interaction and no privileges (AV:L/PR:N/UI:R); an out-of-bounds read yields confidentiality loss only (C:H), so I and A set to N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Microsoft Excel (and the broader Office family - Office 2019, Office LTSC 2021/2024, Office for Mac, Microsoft 365 Apps for Enterprise, and Office Online Server) allows an attacker to read memory beyond an allocated buffer when a victim opens a crafted spreadsheet, potentially leaking sensitive in-process data. Exploitation is local and requires user interaction (opening the malicious file); there is no public exploit identified at time of analysis and CISA SSVC scores exploitation as 'none'. EPSS is very low (0.06%, 18th percentile), indicating negligible observed exploitation activity, though the technical impact is rated 'total'.
Technical ContextAI
The flaw is a CWE-125 out-of-bounds read in Excel's file-parsing logic. When Excel deserializes a spreadsheet, malformed length, offset, or index fields in the file structure can cause the parser to read past the bounds of an allocated buffer. The disclosed bytes are adjacent heap/stack memory that may contain pointers, tokens, or other document/session data. Affected CPEs confirm this spans the shared Office code base rather than a single SKU: microsoft_excel_2016, microsoft_office_2019, microsoft_office_ltsc_2021/2024, the macOS LTSC builds, microsoft_365_apps_for_enterprise, and office_online_server - indicating the vulnerable component is common Office/Excel parsing code reused across desktop, Mac, and server rendering products.
RemediationAI
Apply the Microsoft-released patches, which are available per the MSRC advisory. For Excel 2016 update to build 16.0.5552.1000 or later, for Office LTSC for Mac 2021/2024 update to 16.109.26051019 or later, and for Office Online Server update to 16.0.10417.20128 or later; for Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise, install the current Office security release from https://aka.ms/OfficeSecurityReleases via your normal update channel (Click-to-Run, WSUS, or Intune). The canonical advisory is https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40360. Until patches are deployed, reduce exposure by opening untrusted spreadsheets in Protected View and ensuring Protected View is enforced for files from the Internet, email attachments, and unsafe locations (trade-off: users must click to enable editing for legitimate files), and by using Office file-block and Attachment Manager / mark-of-the-web policies to quarantine spreadsheets from untrusted sources (trade-off: may block legitimate inbound files and require exception handling).
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today