EUVD-2026-56755
GHSA-4p3r-qjm5-hfpj
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local vector confirmed by description; no privileges needed, but victim must open the file (UI:R); only confidentiality is impacted.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Microsoft Excel arises from use of uninitialized memory (CWE-908), exposing potentially sensitive heap or stack contents to an attacker when a victim opens a maliciously crafted Excel file. Affected products span the full Microsoft Office portfolio on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, Excel 2016, and their Mac counterparts. No public exploit identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Technical ContextAI
CWE-908 (Use of Uninitialized Resource) occurs when a code path reads from memory that was allocated but never written with a valid value before use, allowing residual data from prior allocations to be surfaced. In Excel's parsing or rendering pipeline - likely triggered during processing of a specially crafted spreadsheet structure - a buffer or object is allocated without initialization, and its raw contents (which may include leftover process memory containing credentials, tokens, or other sensitive data) can be returned to or observed by the attacker-controlled file. CPE data confirms the flaw spans Excel 2016 (version 16.0.0.0 to below 16.0.5565.1001), Office 365/LTSC/2019 suites on Windows, and Office 365/LTSC for Mac (versions below 16.112.26081010). The local attack vector (AV:L) confirms exploitation occurs entirely within the victim's process context upon file open.
RemediationAI
The primary fix is to apply Microsoft's released patches via the normal Office update channel. For Microsoft Excel 2016 on Windows, upgrade to version 16.0.5565.1001 or later. For macOS products (Office 365 for Mac, Office LTSC for Mac 2021 and 2024), upgrade to version 16.112.26081010 or later. For Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 on Windows, apply the latest update via https://aka.ms/OfficeSecurityReleases. The full advisory is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68799. If immediate patching is not possible, a compensating control is to configure Microsoft Office Protected View to open all externally sourced files in read-only sandboxed mode, which may prevent uninitialized memory paths from being triggered by crafted document structures. Disabling macros organization-wide via Group Policy does not mitigate this specific flaw, as the vulnerability is in the file parser, not the macro engine.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today