EUVD-2026-56460
GHSA-4pc4-7j3h-jqh9
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local vector because exploitation requires opening a crafted file; PR:N as no target-system privileges are needed; C:H reflects meaningful memory disclosure; no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Excel exposes process memory to local information disclosure across a wide range of Office versions, from Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC releases on both Windows and macOS. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms exploitation requires the victim to open a specially crafted spreadsheet file, making phishing-delivered documents the realistic delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Technical ContextAI
The vulnerability is classified as CWE-125 (Out-of-bounds Read), a memory safety defect in which Excel's file parsing engine reads data beyond the boundary of an allocated buffer when processing a crafted spreadsheet. This class of flaw is common in complex binary or structured document format parsers - such as those handling legacy XLS or modern XLSX structures - where attacker-controlled length fields, offsets, or record counts can cause the parser to read into adjacent memory regions. The resulting out-of-bounds read does not corrupt memory (no integrity or availability impact), but can expose runtime memory contents including heap metadata, pointers, or in-process sensitive data. The 'Buffer Overflow' tag in the intelligence data may indicate the out-of-bounds read shares a root cause with a broader memory management weakness in Excel's parsing subsystem, though the CVE description specifically characterizes impact as information disclosure. Affected products span the full Excel and Office ecosystem per ENISA EUVD-2026-56460, including Windows (Excel 2016, Office 2019, LTSC 2021/2024, 365 Apps for Enterprise) and macOS (Office LTSC for Mac 2021/2024, Office 365 for Mac).
RemediationAI
Apply the vendor-released security update via Microsoft Update or the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68808. For Excel 2016 on Windows, update to version 16.0.5565.1001 or later; this is the only Windows product with a specific confirmed fix build in the intelligence data. All other Windows Office versions (2019, LTSC 2021, LTSC 2024, 365 Apps for Enterprise) should be updated to the current release per https://aka.ms/OfficeSecurityReleases, where Microsoft tracks the latest patched builds. For macOS, update Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office 365 for Mac to version 16.112.26081010 or later via Microsoft AutoUpdate or managed deployment. If immediate patching is not feasible, enabling Microsoft Office Protected View for files originating from the internet or email attachments can reduce exploitation risk by opening untrusted documents in a read-only sandbox - note that this does not prevent exploitation if users dismiss Protected View prompts. Restricting execution of Excel files from external or untrusted sources via Group Policy (Trusted Locations, file block settings) is an additional compensating control, though it may impact legitimate workflows that rely on externally sourced spreadsheets.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today