EUVD-2026-44154
GHSA-pfh5-rjff-pjjg
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local vector confirmed by file-open exploitation path; PR:N as attacker supplies the crafted file; UI:R mandatory; only confidentiality impacted via memory leak.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Untrusted pointer dereference in Microsoft Excel exposes sensitive in-process memory to a local attacker across virtually the entire Office product family - Excel 2016 through Office LTSC 2024 on Windows and macOS, plus Office Online Server. An attacker must deliver a crafted spreadsheet and induce the victim to open it; successful exploitation yields high confidentiality impact with no integrity or availability effect. No public exploit code or active exploitation has been identified; EPSS at 0.46% (37th percentile) and SSVC exploitation status of 'none' are consistent with low real-world risk at this time.
Technical ContextAI
CWE-822 (Untrusted Pointer Dereference) arises when an application reads a pointer value from attacker-controlled input and dereferences it without validation, allowing the attacker to direct memory reads to an arbitrary address. In Excel's file-parsing context, a maliciously crafted spreadsheet can embed a synthetic pointer value within a parsed data structure; when Excel processes the file, it follows that pointer and leaks whatever memory resides at that address. CPE strings confirm the flaw spans the full 16.x build line: Windows variants (cpe:2.3:a:microsoft:microsoft_excel_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_365_apps_for_enterprise), macOS variants (microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024), and server-side rendering (office_online_server). The vulnerability is isolated to confidentiality; the CVSS vector S:U (Unchanged Scope) confirms no privilege escalation or process escape is achievable.
RemediationAI
Apply the Microsoft security update for CVE-2026-48580 via Windows Update, Microsoft Update Catalog, or the Office deployment toolchain, following guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48580. For Mac deployments, update to Office 365 for Mac, Office LTSC for Mac 2021, or Office LTSC for Mac 2024 version 16.111.26071215 or later through Microsoft AutoUpdate. For Office Online Server, update to build 16.0.10417.20175 or later; for standalone Excel 2016, update to build 16.0.5561.1001 or later. Where immediate patching is not possible, enable Protected View for files originating from the internet and email attachments (File → Options → Trust Center → Protected View) - this prevents automatic full parsing of untrusted files and blocks the exploitation path, though users will need to manually enable editing for legitimate external files, adding friction to document workflows. Additionally, configuring attack surface reduction (ASR) rules to block Office applications from executing untrusted content provides a layered control with minimal operational overhead.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today