EUVD-2026-44204
GHSA-wqv8-972g-whq4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Local malicious-file open with required user interaction gives AV:L/UI:R; an out-of-bounds read primarily leaks memory (C:H) with only crash-level availability impact (A:L), diverging from the vendor's A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Microsoft Office Excel (2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) lets an attacker read out-of-bounds memory when a victim opens a maliciously crafted spreadsheet, potentially leaking sensitive process data such as memory contents, pointers, or credentials. Rated CVSS 7.1 with a local attack vector requiring user interaction, the flaw stems from a CWE-125 out-of-bounds read in Excel's file parser. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of Excel and Microsoft's confirmed patch make prompt patching important.
Technical ContextAI
The vulnerability is a CWE-125 out-of-bounds read in Microsoft Office Excel's spreadsheet-parsing code. When Excel processes a specially malformed workbook, it reads memory outside the bounds of an allocated buffer - typically the result of trusting an attacker-controlled length, index, or offset field in the file format without proper bounds validation. The CPE data confirms the affected code is shared across the Office family: Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, Office 365/LTSC for Mac 2021/2024, and Office Online Server, indicating a defect in the common Excel rendering/parsing engine rather than a platform-specific bug. Out-of-bounds reads of this class most often disclose adjacent heap or stack memory (potentially defeating ASLR by leaking pointers) and can also cause the application to crash when it dereferences unmapped memory.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-55122 published in the MSRC Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55122); the input confirms a fix is available from the vendor but does not provide an exact fixed build number, so obtain the precise KB/build for each affected SKU (Microsoft 365 Apps, Excel 2016, Office 2019, LTSC 2021/2024, the Mac editions, and Office Online Server) directly from the advisory. For endpoints that cannot be patched immediately, reduce exposure by opening untrusted spreadsheets in Protected View / Office for the web sandbox rather than the full client, blocking or quarantining Excel attachments from untrusted external senders at the mail gateway, and enabling Attack Surface Reduction rules that constrain Office child-process and file behavior - with the trade-off that aggressive attachment blocking and Protected View enforcement can disrupt legitimate business workflows that rely on macro-enabled or externally sourced workbooks. Because exploitation requires the user to open a file, security-awareness reminders about unsolicited spreadsheets provide meaningful defense-in-depth until patching completes.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today