What is the CVSS score of CVE-2026-70328?

CVE-2026-70328 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.9%.

Is there a patch available for CVE-2026-70328?

Yes, a patch is available for CVE-2026-70328. Update the affected software to the latest version immediately.

Microsoft Excel CVE-2026-70328

EUVD-2026-56584 MEDIUM

Out-of-bounds Read (CWE-125)

2026-08-11 secure@microsoft.com

GHSA-w8qr-fj2w-hvr6

Buffer Overflow Information Disclosure Microsoft 365 Apps Excel Microsoft 365 Office 2021 Office 2024 Office 2019

6.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

File-borne delivery requires user interaction (UI:R); no attacker authentication needed; impact is confidentiality-only with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:04 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:19 nvd

MEDIUM 6.5

DescriptionCVE.org

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Out-of-bounds read in Microsoft Office Excel enables remote information disclosure when a user opens a specially crafted spreadsheet. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms that an unauthenticated network-based attacker can trigger the flaw, but only after social engineering a victim into opening a malicious file. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected Office product lines.

Technical ContextAI

CWE-125 (Out-of-Bounds Read) describes a class of memory-safety flaw in which a parser reads beyond the boundaries of an allocated buffer. In this case, the Excel file parser processes a maliciously structured spreadsheet in a way that causes it to read past valid memory, potentially exposing adjacent memory contents - which may include in-memory document data, credentials, or other sensitive information. Affected products span the full current Office portfolio: Office 365 for Mac (below 16.112.26081010), Office LTSC for Mac 2021 and 2024 (below 16.112.26081010), Microsoft Excel 2016 (below 16.0.5565.1001), Office LTSC 2021, Office LTSC 2024, and Office 2019 for Windows (all below the versions linked at https://aka.ms/OfficeSecurityReleases). The flaw is tagged as both Information Disclosure and Buffer Overflow, consistent with a read overrun that leaks data without corrupting execution flow.

RemediationAI

Apply the vendor-released patch immediately via Microsoft Update or the Office update mechanism. For Mac-based Office installations (Office 365 for Mac, LTSC for Mac 2021, LTSC for Mac 2024), update to version 16.112.26081010 or later. For Microsoft Excel 2016, update to version 16.0.5565.1001 or later. For Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024, and Office 2019 on Windows, follow the guidance at https://aka.ms/OfficeSecurityReleases, which tracks the current patched release. Full advisory details are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70328. As a compensating control where patching is delayed, organizations can configure Protected View to open all externally sourced Excel files in read-only sandboxed mode - note this may disrupt macro-dependent workflows. Blocking delivery of .xlsx and .xls attachments from external senders at the mail gateway is a higher-friction workaround with significant operational cost but would eliminate the primary delivery vector.