EUVD-2026-44228
GHSA-vqrv-f82h-5296
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Local crafted-file open with required user interaction and no privileges (AV:L/UI:R/PR:N); out-of-bounds read yields C:H, and I is N; A set to N as impact is disclosure though vendor rated A:H for possible crash.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Microsoft Excel (across Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) lets an attacker read out-of-bounds heap memory when a victim opens a maliciously crafted spreadsheet, potentially leaking sensitive process memory. The flaw (CWE-125, CVSS 7.1) requires local user interaction and no privileges, but is not remotely triggerable without the user opening the file. There is no public exploit identified at time of analysis, EPSS is low at 0.30%, and CISA SSVC rates exploitation as none.
Technical ContextAI
The vulnerability is an out-of-bounds read (CWE-125) in Excel's file-parsing code, meaning Excel reads memory past the bounds of an allocated buffer while processing a malformed spreadsheet structure (e.g., a crafted record, cell, or object within a workbook). Because the read reaches adjacent heap memory, contents of that memory can be surfaced back through the application, disclosing information the attacker should not access. The affected code is shared across the Office Excel engine, which is why the CPE set spans Windows Office builds (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024), the macOS builds (Office 365/LTSC for Mac), and the server-side Office Online Server rendering component. Root cause is missing or insufficient bounds validation before reading structured document data.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security updates referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55898 and https://aka.ms/OfficeSecurityReleases. Concrete fixed builds include Excel 2016 at 16.0.5561.1001 or later, Office Online Server at 16.0.10417.20175 or later, and the Office for Mac builds at 16.111.26071215 or later; Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 receive the fix through their standard update channels, so ensure automatic updates or your patch-management pipeline (WSUS/Intune/Click-to-Run) deploy the current release. Until patched, reduce exposure by not opening untrusted spreadsheets and enabling Protected View / Office File Block policies for Excel documents arriving from email or the internet, and configure Attack Surface Reduction rules to constrain Office behavior; note that aggressive File Block or disabling document opening can disrupt legitimate workflows, so scope these controls to untrusted sources.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today