EUVD-2026-44187
GHSA-v936-2qfp-r4vf
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
File-parsing flaw requires victim to open a crafted document (AV:L, UI:R); no prior system privileges needed by attacker (PR:N); impact confined to confidentiality of the vulnerable process (C:H/I:N/A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Untrusted pointer dereference (CWE-822) in Microsoft Excel allows a local attacker to disclose sensitive memory contents when a victim opens a specially crafted workbook. The flaw affects a broad swath of Microsoft Office product lines - from Excel 2016 through Office LTSC 2024 and their Mac counterparts - as confirmed by CPE enumeration. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and technical impact as partial, placing this in the moderate real-world priority tier despite the C:H CVSS rating.
Technical ContextAI
CWE-822 (Untrusted Pointer Dereference) arises when a program dereferences a pointer value derived from untrusted input without first validating that it points to a legitimate, expected memory region. In Excel's file-parsing routines, a maliciously crafted workbook can supply a pointer value that, when dereferenced during document processing, reads from an attacker-influenced memory address and leaks its contents. The affected components span the entire modern Microsoft Office stack: CPE data identifies cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, cpe:2.3:a:microsoft:microsoft_excel_2016, cpe:2.3:a:microsoft:microsoft_office_2019, cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_2024, their respective Mac LTSC and M365 variants, and Office Online Server - indicating the vulnerable parsing logic is shared across the Office code base rather than isolated to a single product branch.
RemediationAI
Apply the vendor-released patch confirmed available through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55138; deploy via Windows Update, Microsoft Update Catalog, or enterprise patch management tools such as WSUS or Intune. Exact patched build numbers are not independently confirmed from available data - verify the specific version against the MSRC advisory before closing remediation tickets. As a compensating control prior to patching, ensure Excel's Protected View is enabled for files originating from the internet, email attachments, and potentially unsafe locations (File > Options > Trust Center > Protected View), which sandboxes document parsing and limits memory access by the untrusted content. For high-risk environments, consider deploying Microsoft Defender Application Guard for Office to fully isolate untrusted document processing in a hardware-virtualized container. Note that Protected View can be bypassed if users habitually click 'Enable Editing,' so user awareness training is a necessary complement, not a standalone control.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today