EUVD-2026-44039
GHSA-cpg5-9rxq-hxph
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Local vector because exploitation requires opening a crafted file; UI:R for mandatory victim interaction; PR:N since no OS privileges beyond file access are needed; A:H reflects crash from invalid read; C:L for incidental memory disclosure; I:N as no write occurs.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Excel's spreadsheet parser (CWE-125) exposes affected systems to both local information disclosure and application crash when a victim opens a specially crafted file, spanning Excel 2016 through Office LTSC 2024 and Office 365 for Mac. The CVSS vector (AV:L/UI:R/A:H) reveals that while the CVE description emphasizes information disclosure, the primary real-world impact is application availability - the invalid memory read can crash Excel (A:H), with incidental memory content leakage (C:L) as a secondary effect. No public exploit code has been identified at time of analysis and CISA SSVC assigns exploitation status of none, consistent with a low EPSS score of 0.31% at the 23rd percentile.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) describes a class of memory safety flaw where a parsing component reads beyond the intended bounds of an allocated buffer, typically due to insufficient validation of size, offset, or count fields sourced from untrusted input - in this case a crafted Excel workbook file. When the out-of-bounds read references unmapped memory it triggers an access violation that crashes the process (explaining A:H), and when it reads mapped but unintended memory it can expose adjacent heap or stack content (explaining C:L). This dual behavior is characteristic of CWE-125 in file-format parsers. The full affected product surface per CPE includes: microsoft:microsoft_excel_2016, microsoft:microsoft_365_apps_for_enterprise, microsoft:microsoft_office_2019, microsoft:microsoft_office_ltsc_2021, microsoft:microsoft_office_ltsc_2024, microsoft:microsoft_office_365_for_mac, microsoft:microsoft_office_ltsc_for_mac_2021, microsoft:microsoft_office_ltsc_for_mac_2024, and microsoft:office_online_server - covering both Windows and macOS deployments and the server-side Online Server component.
RemediationAI
Apply vendor-released patches via Microsoft Update. For Microsoft Excel 2016, update to version 16.0.5561.1001 or later. For Office Online Server, update to version 16.0.10417.20175 or later. For Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024, update to version 16.111.26071215 or later. For Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 (Windows), consult the channel release schedule at https://aka.ms/OfficeSecurityReleases for the current patched build applicable to your update channel. As a compensating control pending patch deployment, ensure Excel's Protected View is enabled for files originating from the internet or email attachments (File > Options > Trust Center > Protected View); this opens untrusted files in a sandboxed read-only mode, reducing the likelihood of the OOB read being triggered in a context where the attacker controls interaction, though it does not prevent the vulnerability if the user clicks 'Enable Editing'. Disabling the automatic opening of Excel files from untrusted network shares and email at the mail gateway adds defense-in-depth. Full advisory details are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54988.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today