EUVD-2026-56753
GHSA-c5cq-7c9q-gfxq
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Victim must locally open the crafted file (AV:L, UI:R); attacker needs no credentials (PR:N); only memory read occurs, yielding confidentiality impact only (I:N, A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Excel enables local information disclosure when a user opens a specially crafted spreadsheet. Multiple product lines are affected across Windows and macOS, spanning Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise. Microsoft has released patches; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory safety defect that occurs when Excel's file parsing logic accesses memory beyond the boundary of an allocated buffer while processing a crafted spreadsheet. This class of flaw typically arises when length fields, array indices, or record size values in structured file formats are not validated before being used to index into memory, allowing the parser to read data from adjacent memory regions. Affected product lines span both Windows and macOS Office deployments: Microsoft Excel 2016 (CPE up to build 16.0.5565.1001), Office for Mac products up to build 16.112.26081010, and Windows-based Office LTSC 2021, LTSC 2024, Office 2019, and Microsoft 365 Apps for Enterprise. The ENISA EUVD tracking identifier for this vulnerability is EUVD-2026-56753.
RemediationAI
Apply Microsoft's security update for all affected Office products. For macOS deployments, update Microsoft Office for Mac to version 16.112.26081010 or later - this applies to Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office 365 for Mac. For Microsoft Excel 2016 on Windows, update to build 16.0.5565.1001 or later. For Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office 2019, and Office LTSC 2024 on Windows, retrieve the specific fix build numbers and apply updates via https://aka.ms/OfficeSecurityReleases; note that exact Windows build numbers beyond the URL reference were not independently confirmed in the available data. The full vendor advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68797. As an interim compensating control prior to patching, enforcing Microsoft Office Protected View for files originating from the internet or untrusted locations limits parser exposure by opening such files in a read-only sandbox, though this is not a substitute for patching and may impact user workflow for document editing.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today