EUVD-2026-44038
GHSA-r583-mmgv-j5q5
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Local vector confirmed by file-open trigger; no privileges needed from attacker; only partial confidentiality loss with zero integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Heap-based buffer overflow in Microsoft Office Excel triggers a local information disclosure when a target user opens a maliciously crafted document. Affecting Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, the vulnerability yields only limited confidentiality impact (C:L) with no integrity or availability consequence, placing it in the Low severity tier at CVSS 3.3. No public exploit code exists and no active exploitation has been confirmed - CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial, consistent with the low EPSS probability of 0.27% (19th percentile).
Technical ContextAI
CWE-122 (Heap-based Buffer Overflow) identifies the root cause: Excel's document-parsing engine writes beyond the bounds of a heap-allocated buffer when processing a crafted spreadsheet file. Unlike heap overflows that enable arbitrary code execution, the overflow here is constrained such that only adjacent heap memory contents are disclosed rather than control flow being hijacked - likely due to bounds checks that prevent write-past-end from corrupting critical pointers. The affected products span the full Microsoft Office ecosystem: Excel 2016 (CPE: cpe:2.3:a:microsoft:microsoft_excel_2016), Office 2019, Office LTSC 2021 and 2024 (Windows and macOS variants), Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office Online Server, as confirmed by EUVD-2026-44038. The attack vector is local (AV:L), meaning the payload must be processed on the victim's machine rather than reaching the parsing engine over a network protocol.
RemediationAI
Apply the vendor-released patches via Microsoft Update or Click-to-Run auto-update. Specific confirmed fix versions are: Microsoft Excel 2016 updated to 16.0.5561.1001 or later; Office Online Server updated to 16.0.10417.20175 or later; all Mac variants (Office LTSC for Mac 2021, Office LTSC for Mac 2024, Office 365 for Mac) updated to build 16.111.26071215 or later. For Windows-based Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise, consult https://aka.ms/OfficeSecurityReleases for the specific build numbers released by Microsoft. The full advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50678. As a compensating control where immediate patching is not feasible, organizations can configure Protected View to open untrusted documents in sandboxed read-only mode (already default for files received from the internet or email), which limits the attacker's ability to trigger the overflow through typical delivery channels. Restricting macro-enabled and external-link-bearing documents via Group Policy adds defense-in-depth but does not directly block this parsing-layer vulnerability.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today