EUVD-2026-44228
GHSA-vqrv-f82h-5296
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Excel file
-
DeliveryDeliver via email or download
-
ExploitVictim opens spreadsheet
-
ExecutionExcel parses malformed record
-
PersistOut-of-bounds heap read
-
ImpactDisclose sensitive memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to locally open an attacker-crafted Excel spreadsheet - user interaction (UI:R) is mandatory, so this cannot be triggered remotely without the user opening the malicious file. No authentication or elevated privileges are needed (PR:N), and no special product configuration is required beyond a vulnerable, unpatched Excel/Office build on Windows or macOS, or Office Online Server rendering the file. Limiting factors: the need for user interaction, the local attack vector (the file must reach and be opened on the target), and mitigations such as Protected View, which opens internet-sourced files in a sandboxed read-only mode that blunts casual triggering. |
| Impact | Signals are consistent and point to a moderate, opportunistic risk rather than an urgent one. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) confirms local access with required user interaction and no authentication, giving a base of 7.1 driven by high confidentiality and availability impact. This aligns with CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: partial) and a low EPSS of 0.30% (22nd percentile), all indicating no observed exploitation and low near-term probability. There is no CISA KEV listing and no public exploit identified. One point to verify: the vector rates A:H (high availability impact) for what the description characterizes purely as information disclosure - the availability impact likely reflects that an out-of-bounds read can also crash Excel, but confirm scope with the MSRC advisory. Net: a real patch-worthy issue but a routine-priority one, not an emergency, absent evidence of exploitation. |
| Exploit ScenarioDerived | An attacker emails or otherwise delivers a crafted Excel spreadsheet to a target and lures them into opening it; when Excel parses the malformed structure, it reads out-of-bounds heap memory, and the leaked contents (potentially credentials, tokens, or other in-process data) can be surfaced to the attacker or cause the application to crash. Because AV is local and UI is required, the attack hinges on social engineering to get the victim to open the file. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Information disclosure in Microsoft Excel (across Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) lets an attacker read out-of-bounds heap memory when a victim opens a maliciously crafted spreadsheet, potentially leaking sensitive process memory. The flaw (CWE-125, CVSS 7.1) requires local user interaction and no privileges, but is not remotely triggerable without the user opening the file. There is no public exploit identified at time of analysis, EPSS is low at 0.30%, and CISA SSVC rates exploitation as none.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security updates referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55898 and https://aka.ms/OfficeSecurityReleases. Concrete fixed builds include Excel 2016 at 16.0.5561.1001 or later, Office Online Server at 16.0.10417.20175 or later, and the Office for Mac builds at 16.111.26071215 or later; Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 receive the fix through their standard update channels, so ensure automatic updates or your patch-management pipeline (WSUS/Intune/Click-to-Run) deploy the current release. Until patched, reduce exposure by not opening untrusted spreadsheets and enabling Protected View / Office File Block policies for Excel documents arriving from email or the internet, and configure Attack Surface Reduction rules to constrain Office behavior; note that aggressive File Block or disabling document opening can disrupt legitimate workflows, so scope these controls to untrusted sources.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an out-of-bounds read (CWE-125) in Excel's file-parsing code, meaning Excel reads memory past the bounds of an allocated buffer while processing a malformed spreadsheet structure (e.g., a crafted record, cell, or object within a workbook). Because the read reaches adjacent heap memory, contents of that memory can be surfaced back through the application, disclosing information the attacker should not access. The affected code is shared across the Office Excel engine, which is why the CPE set spans Windows Office builds (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024), the macOS builds (Office 365/LTSC for Mac), and the server-side Office Online Server rendering component. Root cause is missing or insufficient bounds validation before reading structured document data.
Know when Office Online Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Local crafted-file open with required user interaction and no privileges (AV:L/UI:R/PR:N); out-of-bounds read yields C:H, and I is N; A set to N as impact is disclosure though vendor rated A:H for possible crash.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Executive ViewAI
Microsoft Excel contains an information disclosure vulnerability (CVE-2026-55898, CVSS 7.1) affecting Microsoft 365, Office 2016/2019, LTSC editions, Mac, and Online Server that allows attackers to extract sensitive process memory by sending malicious spreadsheets to victims. While exploitation likelihood is low (0.3% EPSS, requires user interaction), the vulnerability carries data leakage risk and affects widespread Office deployments. Vendor patch is available and should be deployed as priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Exploit-DB