EUVD-2026-44164
GHSA-jmxw-46f3-mx5p
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Consistent with vendor vector - local file-open required (AV:L), no attacker privileges needed (PR:N), victim must open the crafted file (UI:R), confidentiality impact only with no integrity or availability consequence.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Excel's file parsing engine exposes sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016 through Office LTSC 2024 and Office Online Server across both Windows and macOS platforms. The CVSS vector (AV:L/UI:R/C:H/I:N/A:N) confirms impact is limited to confidentiality loss - no code execution results - and requires local user interaction to trigger. No public exploit has been identified and CISA has not listed this in KEV; with an EPSS of 0.46% and SSVC exploitation status of none, this is appropriate for standard patch cycle prioritization rather than emergency response.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) describes a class of memory safety flaw where a software component reads data from a memory address beyond the allocated buffer boundary, potentially exposing adjacent heap or stack memory to an attacker-influenced output path. In this case, the flaw resides in Microsoft Excel's workbook parsing logic - the component that processes structured spreadsheet record formats such as .xlsx or legacy .xls binary streams. When Excel encounters a specially structured record during file open, the parser advances a read pointer beyond the end of the intended data region. The exposed memory may contain sensitive document contents, recently freed heap data, or internal application state. Affected products confirmed via CPE include: cpe:2.3:a:microsoft:microsoft_excel_2016, cpe:2.3:a:microsoft:microsoft_office_2019, cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_2024, cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, cpe:2.3:a:microsoft:microsoft_office_365_for_mac, cpe:2.3:a:microsoft:microsoft_office_ltsc_for_mac_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_for_mac_2024, and cpe:2.3:a:microsoft:office_online_server. The inclusion of Office Online Server is noteworthy as it implies a potential server-side parsing path depending on how documents are processed in that deployment.
RemediationAI
Apply vendor-released patches via Microsoft Update, Windows Update for Business, or the Microsoft 365 admin center. Confirmed fix versions from EUVD data: Microsoft Excel 2016 must be updated to 16.0.5561.1001 or later; Office Online Server to 16.0.10417.20175 or later; Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024 must reach build 16.111.26071215 or later. For Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024 on Windows, consult https://aka.ms/OfficeSecurityReleases for the current patched build number. As a compensating control pending patching, ensure Excel's Protected View is enabled for files originating from the internet or email attachments (File > Options > Trust Center > Protected View) - this opens untrusted documents in a restricted sandbox that still parses the file but limits what the parser output can reach. Note that Protected View does not prevent the out-of-bounds read from occurring; it reduces the attacker's ability to leverage any disclosed memory. For Office Online Server deployments processing untrusted documents, consider restricting document upload sources or routing uploads through a sandboxed pre-processing tier until the patch is applied.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today