EUVD-2026-44154
GHSA-pfh5-rjff-pjjg
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local vector confirmed by file-open exploitation path; PR:N as attacker supplies the crafted file; UI:R mandatory; only confidentiality impacted via memory leak.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Untrusted pointer dereference in Microsoft Excel exposes sensitive in-process memory to a local attacker across virtually the entire Office product family - Excel 2016 through Office LTSC 2024 on Windows and macOS, plus Office Online Server. An attacker must deliver a crafted spreadsheet and induce the victim to open it; successful exploitation yields high confidentiality impact with no integrity or availability effect. No public exploit code or active exploitation has been identified; EPSS at 0.46% (37th percentile) and SSVC exploitation status of 'none' are consistent with low real-world risk at this time.
Technical ContextAI
CWE-822 (Untrusted Pointer Dereference) arises when an application reads a pointer value from attacker-controlled input and dereferences it without validation, allowing the attacker to direct memory reads to an arbitrary address. In Excel's file-parsing context, a maliciously crafted spreadsheet can embed a synthetic pointer value within a parsed data structure; when Excel processes the file, it follows that pointer and leaks whatever memory resides at that address. CPE strings confirm the flaw spans the full 16.x build line: Windows variants (cpe:2.3:a:microsoft:microsoft_excel_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_365_apps_for_enterprise), macOS variants (microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024), and server-side rendering (office_online_server). The vulnerability is isolated to confidentiality; the CVSS vector S:U (Unchanged Scope) confirms no privilege escalation or process escape is achievable.
RemediationAI
Apply the Microsoft security update for CVE-2026-48580 via Windows Update, Microsoft Update Catalog, or the Office deployment toolchain, following guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48580. For Mac deployments, update to Office 365 for Mac, Office LTSC for Mac 2021, or Office LTSC for Mac 2024 version 16.111.26071215 or later through Microsoft AutoUpdate. For Office Online Server, update to build 16.0.10417.20175 or later; for standalone Excel 2016, update to build 16.0.5561.1001 or later. Where immediate patching is not possible, enable Protected View for files originating from the internet and email attachments (File → Options → Trust Center → Protected View) - this prevents automatic full parsing of untrusted files and blocks the exploitation path, though users will need to manually enable editing for legitimate external files, adding friction to document workflows. Additionally, configuring attack surface reduction (ASR) rules to block Office applications from executing untrusted content provides a layered control with minimal operational overhead.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today