EUVD-2026-56583
GHSA-2q7m-9rpm-xprw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered file triggers parsing remotely (AV:N, AC:L, PR:N); victim must open the file (UI:R); impact is read-only memory disclosure with no integrity or availability consequence (C:H/I:N/A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Out-of-bounds read in Microsoft Excel exposes sensitive memory contents over a network to unauthenticated remote attackers, resulting in high-confidence information disclosure (C:H). Exploitation requires user interaction - specifically, opening a crafted Excel document - placing this firmly in the phishing/malicious-attachment delivery class. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at the time of analysis, though the patch is available and should be applied promptly given the ubiquity of the affected product across enterprise environments.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) describes a flaw in which a parsing or processing routine reads memory beyond the bounds of the allocated buffer. In the context of Microsoft Excel, this likely occurs within the spreadsheet file parsing subsystem - potentially the XLS, XLSX, or related format handler - where insufficient bounds validation allows crafted cell, record, or formula data to cause the application to read adjacent memory regions. The EUVD-confirmed affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, Excel 2016, and the Mac variants (Office 365 for Mac, LTSC for Mac 2021/2024). Although the tag 'Buffer Overflow' appears alongside 'Information Disclosure,' the CVSS vector's I:N and A:N metrics confirm this is a read-only memory exposure, not a write primitive - consistent with CWE-125 rather than a classic write-overflow (CWE-122). The disclosed memory could include heap metadata, file content, cryptographic material, or other in-process data depending on the memory layout at time of exploitation.
RemediationAI
The primary remediation is to apply the vendor-released patch via Microsoft Update or the Microsoft Update Catalog. For Microsoft Excel 2016 on Windows, update to build 16.0.5565.1001 or later. For all Mac variants (Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office 365 for Mac), update to version 16.112.26081010 or later. For Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 2019 on Windows, apply the latest updates via the Office Release Health channel at https://aka.ms/OfficeSecurityReleases - specific build numbers for these SKUs were not independently confirmed in the available data. As a compensating control where patching is delayed, configure Protected View to open files from the internet, email, and potentially unsafe locations in a sandboxed read-only mode, which limits the attacker's ability to trigger parsing of malicious content in a fully-privileged context. Disabling macros and enabling Attack Surface Reduction rules targeting Office child processes can reduce the blast radius, though these controls do not directly prevent the OOB read from being triggered. Deploy endpoint detection to alert on Excel spawning unexpected network connections, which may indicate post-exploitation reconnaissance following memory disclosure.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today