EUVD-2026-100177
GHSA-mxmg-6w3r-xj54
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Excel file via email
-
DeliveryVictim opens malicious spreadsheet
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionLeak adjacent process memory
-
ImpactExfiltrate disclosed information to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted Excel file in Microsoft Office Excel (UI:R confirmed by CVSS), so there is no automatic or server-side trigger - this is the primary limiting factor and aligns with SSVC Automatable=no. No authentication or prior privileges are needed (PR:N), and the vector is network/file-delivery-based (AV:N), meaning the malicious document can be delivered remotely via email or web. Affected builds per EUVD: Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise; patched builds are not exploitable. Impact is limited to information disclosure (C:H, I:N, A:N) - no code execution or data modification results directly from this flaw. |
| Impact | This is a moderate-priority information disclosure flaw, not a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a network-delivered attack requiring no privileges but mandatory user interaction, with high confidentiality impact and no integrity or availability impact - consistent with an out-of-bounds read (CWE-125) leaking memory contents from Excel. The signals are internally consistent and point AWAY from widespread/urgent risk: SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, which aligns with the lack of any KEV listing and no identified public exploit code. The UI:R requirement means an attacker cannot exploit this at scale automatically - a victim must open a crafted file - matching SSVC Automatable=no. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. Net: real but not a drop-everything issue; patch on normal Patch Tuesday cadence. No conflicting signals were found, though the 'Buffer Overflow' tag is a loose fit since CWE-125 is an out-of-bounds READ (disclosure), not a write-based overflow. |
| Exploit ScenarioDerived | An attacker emails a victim a maliciously crafted Excel spreadsheet (e.g., as an attachment or download link). When the victim opens the file, Excel performs an out-of-bounds read while parsing it, disclosing adjacent process memory - potentially leaking sensitive data such as pointers or document fragments back to the attacker. No public exploit code was identified at the time of analysis, and SSVC lists exploitation as none. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read in Microsoft Office Excel lets an unauthenticated remote attacker disclose memory contents by convincing a victim to open a specially crafted spreadsheet (CVSS 3.1 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Affected builds are Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise; patched builds are not vulnerable. The impact is confined to information disclosure with no integrity or availability effect, and there is no public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation=none and Automatable=no, with Technical Impact=partial.
RemediationAI
Apply the vendor-released patch: Microsoft published an update for CVE-2026-88172 through the MSRC Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88172), which brings Office LTSC 2021 to build 16.0.14334.20974 or later and Office LTSC 2024 to build 16.0.17932.21056 or later; Microsoft 365 Apps for Enterprise customers should confirm their channel is at a build listed at https://aka.ms/OfficeSecurityReleases and force an update if it lags. Verify remediation by comparing the installed Office build number against these thresholds rather than relying on the update having been offered. Where immediate patching is not possible, deploy targeted compensating controls with known trade-offs: keep Protected View and Mark-of-the-Web enforcement enabled for files originating from the internet or email (blocks the crafted file from rendering in the full parser, at the cost of extra clicks and occasional prompt fatigue for users), and use Windows Defender Application Control or Office's trusted-location policy plus email attachment filtering to stop untrusted workbooks from reaching users at all - accepting that these reduce business document flow and can be bypassed if users are allowed to disable Protected View. Microsoft Defender Attack Surface Reduction rules that block Office child-process creation and executable content do not address this parsing-level disclosure and should not be treated as a substitute for the patch. Prioritize this as a moderate-priority information-disclosure fix rather than a critical emergency, driving completion by the presence of unpatched, user-interactive Excel deployments that routinely open externally sourced spreadsheets.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a classic out-of-bounds read (CWE-125) in Excel's file-format parsing code. When Excel opens a workbook, it parses containers of records and streams whose length and offset fields are attacker-controlled; a miscalculated bounds check or unvalidated size field causes the parser to read past the end of an allocated buffer. The bytes returned from adjacent heap memory may then be surfaced through the document's rendered or exported content, giving the attacker a memory-disclosure primitive rather than code execution - consistent with the assessed vector, which scores C:H but I:N/A:N. Any leaked data could include pointers or residual document content useful for defeating ASLR in a separate exploit chain, so the flaw's value is as an information-gathering step. The UI:R component is decisive: exploitation is not automatable and requires the target to open the crafted file in a vulnerable Excel build, matching SSVC Automatable=no; PR:N means no credentials or prior foothold are needed and delivery can occur remotely by email attachment or web download. No CPE mapping was supplied, but EUVD pins the affected product families and build thresholds.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
File delivered over network (AV:N) with no auth (PR:N) but mandatory victim file-open (UI:R); out-of-bounds read discloses memory (C:H) without integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB