EUVD-2026-44161
GHSA-99rr-9h5v-ch7f
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file delivery requires no privileges; user must open the crafted file; only confidentiality is impacted via memory read with no integrity or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Excel and related Office products exposes adjacent process memory to local information disclosure when a user opens a specially crafted spreadsheet file. The flaw spans a broad set of Microsoft Office versions across Windows and macOS - including Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server - with vendor-released patches now available for all affected builds. No active exploitation has been confirmed by CISA KEV, and EPSS places exploitation probability at 0.35% (27th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable delivery.
Technical ContextAI
The root cause is CWE-125 (Out-of-Bounds Read), a memory safety defect in Excel's file parser where attacker-controlled field values - such as record lengths or array sizes within the Excel file format (XLS, XLSX, or XLSB structures) - are not validated against actual buffer boundaries before memory is accessed, causing the parser to read beyond the allocated region. Affected products confirmed via CPE strings span both Windows and macOS platforms: Microsoft Excel 2016 (cpe:2.3:a:microsoft:microsoft_excel_2016), Microsoft Office 2019, LTSC 2021, and LTSC 2024 (cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, microsoft_office_ltsc_2024), Microsoft 365 Apps for Enterprise (cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise), Office 365 for Mac and LTSC Mac variants (cpe:2.3:a:microsoft:microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024), and Office Online Server (cpe:2.3:a:microsoft:office_online_server). Out-of-bounds reads in document parsers frequently expose adjacent heap or stack memory, which may contain sensitive in-process data depending on memory layout at the time of exploitation.
RemediationAI
Vendor-released patches are available for all affected products per the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50408. Specific minimum fix builds confirmed via EUVD-2026-44161: Microsoft Excel 2016 must be updated to build 16.0.5561.1001 or later; Office Online Server must be updated to build 16.0.10417.20175 or later; Microsoft Office LTSC for Mac 2021, LTSC for Mac 2024, and Office 365 for Mac must be updated to build 16.111.26071215 or later. For Microsoft Office 2019, LTSC 2021 (Windows), LTSC 2024 (Windows), and Microsoft 365 Apps for Enterprise, apply the latest updates via the Office Security Releases page at https://aka.ms/OfficeSecurityReleases - specific Windows build numbers for these products are not independently confirmed from the available data. As a compensating control where immediate patching is delayed, enforce Protected View for files downloaded from the internet or received via email, which prevents automatic parsing of untrusted spreadsheets; note this requires user discipline to not dismiss Protected View prompts. Disabling Excel's handling of legacy XLS formats via Group Policy can reduce parser exposure surface, at the cost of compatibility with older files.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today