EUVD-2026-100176
GHSA-c9x7-725v-7r94
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Excel file
-
ExploitDeliver via phishing email
-
ExecutionVictim opens file in Excel
-
ImpactOut-of-bounds read leaks process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open a specially crafted Excel file in an affected build (Microsoft 365 Apps for Enterprise, Office LTSC 2024 below 16.0.17932.21056, Office LTSC 2021 below 16.0.14334.20974, or Office 365 for Mac); this mandatory user interaction (CVSS UI:R) is the primary limiting factor. No authentication is required (PR:N) and no special target-side configuration is needed beyond running a vulnerable Excel version, but the attacker cannot trigger the flaw without the victim opening the malicious document. Impact is limited to information disclosure (memory read) - there is no code execution, data modification, or denial of service inherent to this out-of-bounds read. |
| Impact | This is a genuinely moderate-priority issue, not an overhyped high-CVSS flaw - nor is it a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5 Medium) shows a network-reachable, low-complexity, unauthenticated path, but the UI:R requirement means a user must open a crafted Excel file, which materially lowers real-world exploitability. Impact is confidentiality-only (C:H, no integrity or availability effect), consistent with the CWE-125 out-of-bounds read that leaks memory contents. The CISA SSVC framework strongly corroborates a measured posture: Exploitation=none (no observed activity), Automatable=no (hinges on user interaction, not mass-scriptable), and Technical Impact=partial. EPSS is not provided in the input, so exploitation probability cannot be quantified. No KEV listing and no POC are present in the data, meaning there is no public exploit identified at time of analysis and no confirmed active exploitation. The signals are internally consistent - none conflict - all pointing to a patch-in-normal-cycle vulnerability rather than an urgent out-of-band threat. One note: the 'network' attack vector is a file-delivery artifact (crafted document opened by a user), not a remote service exposure, which defenders should factor into realistic risk. |
| Exploit ScenarioDerived | An attacker crafts a malicious Excel spreadsheet that triggers an out-of-bounds read when parsed, then delivers it to a target via phishing email or a download link. When the victim opens the file in a vulnerable version of Excel, the flaw discloses adjacent process memory to the attacker. No public exploit code is identified at time of analysis, and exploitation requires the user to open the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Information disclosure in Microsoft Excel allows an unauthenticated remote attacker to read memory contents by having a victim open a specially crafted Excel file in a vulnerable build. The flaw is an out-of-bounds read (CWE-125) rated CVSS 6.5 with a UI:R requirement, meaning the victim must open the malicious document - the primary limiting factor - while impact stays confined to confidentiality (C:H) with no code execution, data modification, or denial of service. At time of analysis there is no public exploit identified and no confirmed active exploitation (CISA SSVC: Exploitation none, Automatable no), and vendor patches are available for Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office LTSC 2021, and Office 365 for Mac.
RemediationAI
Vendor-released patches are available: update Microsoft Office LTSC 2024 to build 16.0.17932.21056 or later, Microsoft Office LTSC 2021 to build 16.0.14334.20974 or later, Microsoft 365 Apps for Enterprise to the current channel build published at https://aka.ms/OfficeSecurityReleases, and Microsoft Office 365 for Mac to its latest published release; the authoritative advisory is https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88154. Because exploitation requires the victim to open a crafted Excel file, prioritize patch deployment for users who handle externally sourced spreadsheets, and confirm builds via the Office update channel rather than assuming automatic servicing completed on volume-licensed LTSC installations. Where patching must be staged, compensating controls are: force untrusted attachments and downloads to open in Protected View or Microsoft Defender Application Guard for Office (trade-off: reduced fidelity and slower open times, and Application Guard does not eliminate the flaw for files users mark as trusted); and use mail gateway/file-sharing policy to quarantine or block unsolicited Excel attachments (trade-off: false positives on legitimate business files and no protection for files delivered by other channels). Opening documents only from trusted senders and avoiding enabling editing on unsolicited spreadsheets further reduces exposure, but these are behavioral controls rather than a technical boundary.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an out-of-bounds read (CWE-125) in Excel's parsing/handling of document content: the affected code reads past the end of an allocated memory buffer while processing a crafted spreadsheet, and the resulting memory contents can be returned to the attacker through observable behavior in the file or its output. This is a memory-safety bug class that leaks information rather than corrupting memory: because no out-of-bounds write and no freed-memory reuse is involved, the assessment is limited to information disclosure, and the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects that asymmetry (high confidentiality, no integrity or availability impact). Delivery is network-based (AV:N) with low attack complexity (AC:L), but exploitation is gated entirely by user interaction (UI:R) - a victim must open the weaponized file in a vulnerable Excel build. Relevant affected builds derived from the affected-version data are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2024 below 16.0.17932.21056, Microsoft Office LTSC 2021 below 16.0.14334.20974, and Microsoft Office 365 for Mac. The CVE is tracked under ENISA EUVD-2026-100176 and reported by secure@microsoft.com; CISA's SSVC decision framework classifies exploitation as none, automatability as no, and technical impact as partial, consistent with a document-open-dependent info leak rather than a wormable or remotely automatable flaw.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
File delivered over network but opened by a user, so AV:N/UI:R/PR:N; an out-of-bounds read discloses memory (C:H) with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB