EUVD-2026-44197
GHSA-959p-g3cm-4rcv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
File delivered over network (AV:N), no attacker auth needed (PR:N), victim must open file (UI:R), confidentiality-only memory read impact (C:H, I:N, A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Out-of-bounds read in Microsoft Excel's file parser discloses sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC for Mac 2021/2024, and Office Online Server. The CVSS vector (AV:N/PR:N/UI:R/C:H) indicates unauthenticated network delivery with mandatory user interaction and high confidentiality impact. No public exploit identified at time of analysis; SSVC confirms no known active exploitation and EPSS at 0.64% (46th percentile) reflects below-average exploitation probability, positioning this as a targeted phishing risk rather than an opportunistic threat.
Technical ContextAI
The root cause is CWE-125 (Out-of-Bounds Read), a memory safety defect in Excel's spreadsheet file parser where insufficient bounds validation allows reading beyond the allocated buffer when processing a malformed workbook. This class of vulnerability commonly arises in complex binary or XML-based file format parsers (XLS, XLSX, XLSB) where attacker-controlled length or offset fields are consumed without proper range checks. The CPE data confirms the flaw resides in a shared parsing component spanning nine distinct product lines: cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, cpe:2.3:a:microsoft:microsoft_excel_2016, cpe:2.3:a:microsoft:microsoft_office_2019, cpe:2.3:a:microsoft:microsoft_office_365_for_mac, cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_2024, cpe:2.3:a:microsoft:microsoft_office_ltsc_for_mac_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_for_mac_2024, and cpe:2.3:a:microsoft:office_online_server. The breadth of affected products underscores that the vulnerable code path is shared across the Excel engine rather than isolated to a single edition.
RemediationAI
Apply the vendor-released patch immediately via Microsoft Update or the Microsoft Update Catalog. For Microsoft Excel 2016 on Windows, update to build 16.0.5561.1001 or later - this is the only product line with an explicit confirmed build number. For Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise on Windows, apply the current monthly or semi-annual channel release per https://aka.ms/OfficeSecurityReleases. For Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024, update to version 16.111.26071215 or later. For Office Online Server, update to build 16.0.10417.20175 or later. As a compensating control prior to patching, enforce Protected View for all externally sourced Excel files via Group Policy (configure 'Open files from the Internet in Protected View' and 'Open files in potentially unsafe locations in Protected View') - this sandboxes the parser and limits memory disclosure, though users will need to take an extra step to edit files, which may interrupt workflows. Email gateway rules blocking macro-enabled or legacy-format Excel attachments from external senders provide additional delivery-side reduction. Full advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55054.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today