EUVD-2026-56574
GHSA-5fx6-3jpg-j6pm
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-based trigger requires user to open crafted content (AV:L, UI:R); no prior authentication needed (PR:N); only confidentiality impacted (C:H/I:N/A:N), consistent with described information disclosure.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Improper input validation in Microsoft Office Excel enables a local attacker to disclose sensitive information when a target user opens a specially crafted file. The vulnerability affects a broad swath of Microsoft Office product lines - including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, Office 365 for Mac, and Word 2016 - across both Windows and macOS platforms. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; vendor-released patches are available across all affected product lines.
Technical ContextAI
The root cause is CWE-20 (Improper Input Validation), indicating that Excel's file-parsing or data-processing logic fails to adequately constrain, sanitize, or validate attacker-controlled input before use, ultimately allowing data to leak from the process's accessible memory or local file system. The local attack vector (AV:L) confirms the vulnerability is exercised through a malicious file opened on the local system rather than via a network-facing service. Affected components span both Windows builds (Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Word 2016 up to build 16.0.5565.1000) and macOS builds (Office 365 for Mac, LTSC for Mac 2021/2024, all below build 16.112.26081010), indicating the vulnerable input-handling logic resides in shared Excel library code present across platforms. The unchanged scope (S:U) confirms exploitation is contained within the Excel process boundary.
RemediationAI
Apply vendor-released patches through standard Microsoft Update channels. On macOS, update all affected Office suites (Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024) to build 16.112.26081010 or later. On Windows, update Microsoft Word 2016 to build 16.0.5565.1000 or later; for Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise, apply the current updates referenced at https://aka.ms/OfficeSecurityReleases - exact fixed build numbers for these Windows editions are not enumerated in the available data and should be confirmed via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70318. As an interim measure where patching is delayed, enforce Protected View for Excel files originating from external or untrusted sources via Group Policy (Computer Configuration > Administrative Templates > Microsoft Excel > Excel Options > Security > Trust Center); this limits automated processing of untrusted file content and may prevent exploitation, but restricts immediate editing of received files, impacting users who routinely edit externally sourced spreadsheets.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today