EUVD-2026-44204
GHSA-wqv8-972g-whq4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Local malicious-file open with required user interaction gives AV:L/UI:R; an out-of-bounds read primarily leaks memory (C:H) with only crash-level availability impact (A:L), diverging from the vendor's A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Microsoft Office Excel (2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) lets an attacker read out-of-bounds memory when a victim opens a maliciously crafted spreadsheet, potentially leaking sensitive process data such as memory contents, pointers, or credentials. Rated CVSS 7.1 with a local attack vector requiring user interaction, the flaw stems from a CWE-125 out-of-bounds read in Excel's file parser. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of Excel and Microsoft's confirmed patch make prompt patching important.
Technical ContextAI
The vulnerability is a CWE-125 out-of-bounds read in Microsoft Office Excel's spreadsheet-parsing code. When Excel processes a specially malformed workbook, it reads memory outside the bounds of an allocated buffer - typically the result of trusting an attacker-controlled length, index, or offset field in the file format without proper bounds validation. The CPE data confirms the affected code is shared across the Office family: Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, Office 365/LTSC for Mac 2021/2024, and Office Online Server, indicating a defect in the common Excel rendering/parsing engine rather than a platform-specific bug. Out-of-bounds reads of this class most often disclose adjacent heap or stack memory (potentially defeating ASLR by leaking pointers) and can also cause the application to crash when it dereferences unmapped memory.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-55122 published in the MSRC Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55122); the input confirms a fix is available from the vendor but does not provide an exact fixed build number, so obtain the precise KB/build for each affected SKU (Microsoft 365 Apps, Excel 2016, Office 2019, LTSC 2021/2024, the Mac editions, and Office Online Server) directly from the advisory. For endpoints that cannot be patched immediately, reduce exposure by opening untrusted spreadsheets in Protected View / Office for the web sandbox rather than the full client, blocking or quarantining Excel attachments from untrusted external senders at the mail gateway, and enabling Attack Surface Reduction rules that constrain Office child-process and file behavior - with the trade-off that aggressive attachment blocking and Protected View enforcement can disrupt legitimate business workflows that rely on macro-enabled or externally sourced workbooks. Because exploitation requires the user to open a file, security-awareness reminders about unsolicited spreadsheets provide meaningful defense-in-depth until patching completes.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today