EUVD-2026-35539
GHSA-mghm-jr32-gfh3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionNVD
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Out-of-bounds read in Microsoft Excel exposes limited memory contents to a local attacker when a user opens a specially crafted workbook. Affected product lines span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac variants. With a CVSS score of 3.3 (Low), no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-urgency information disclosure issue - though a notable conflict exists between the description's claim of network-based disclosure and the CVSS AV:L (local) vector that warrants verification against the vendor advisory.
Technical ContextAI
The vulnerability is classified as CWE-125 (Out-of-bounds Read), a memory safety defect in which Excel's file parsing logic reads beyond the bounds of an allocated buffer when processing a crafted spreadsheet file. This class of flaw typically arises in binary format parsers (e.g., legacy .xls or compound document processing) where length or offset values from attacker-controlled file content are not properly validated before indexing into memory. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N confirms the read is local, low-complexity, and yields only partial confidentiality impact with no integrity or availability consequence. The EUVD data identifies affected CPE-equivalent versions across Excel 2016 (below 16.0.5556.1001), Office LTSC 2021/2024, Office 2019, Microsoft 365 Apps for Enterprise, Office Online Server (below 16.0.10417.20137), and Mac variants of the Office suite. Note: the tag 'Buffer Overflow' assigned in the intelligence data is imprecise - CWE-125 is a read-side memory safety issue, not a write-side overflow, and no code execution impact is indicated.
RemediationAI
The primary remediation is to apply the vendor-released patch via Microsoft's standard update channels. For Microsoft Excel 2016, the fixed version is 16.0.5556.1001. For Office Online Server, the fixed version is 16.0.10417.20137. For all other affected products - Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac variants - patched builds are available through the Microsoft Office update guide at https://aka.ms/OfficeSecurityReleases; consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45455 for specific build numbers. As a compensating control where immediate patching is not possible, consider restricting users from opening Excel files received from untrusted external sources (e.g., enforcing Protected View policies via Group Policy or Intune), which limits the UI:R trigger surface. Note that Protected View does not fully eliminate risk if users habitually dismiss the prompt. No workaround eliminates the underlying OOB read; patching is the definitive fix.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today