EUVD-2026-44161
GHSA-99rr-9h5v-ch7f
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file delivery requires no privileges; user must open the crafted file; only confidentiality is impacted via memory read with no integrity or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Excel and related Office products exposes adjacent process memory to local information disclosure when a user opens a specially crafted spreadsheet file. The flaw spans a broad set of Microsoft Office versions across Windows and macOS - including Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server - with vendor-released patches now available for all affected builds. No active exploitation has been confirmed by CISA KEV, and EPSS places exploitation probability at 0.35% (27th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable delivery.
Technical ContextAI
The root cause is CWE-125 (Out-of-Bounds Read), a memory safety defect in Excel's file parser where attacker-controlled field values - such as record lengths or array sizes within the Excel file format (XLS, XLSX, or XLSB structures) - are not validated against actual buffer boundaries before memory is accessed, causing the parser to read beyond the allocated region. Affected products confirmed via CPE strings span both Windows and macOS platforms: Microsoft Excel 2016 (cpe:2.3:a:microsoft:microsoft_excel_2016), Microsoft Office 2019, LTSC 2021, and LTSC 2024 (cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, microsoft_office_ltsc_2024), Microsoft 365 Apps for Enterprise (cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise), Office 365 for Mac and LTSC Mac variants (cpe:2.3:a:microsoft:microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024), and Office Online Server (cpe:2.3:a:microsoft:office_online_server). Out-of-bounds reads in document parsers frequently expose adjacent heap or stack memory, which may contain sensitive in-process data depending on memory layout at the time of exploitation.
RemediationAI
Vendor-released patches are available for all affected products per the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50408. Specific minimum fix builds confirmed via EUVD-2026-44161: Microsoft Excel 2016 must be updated to build 16.0.5561.1001 or later; Office Online Server must be updated to build 16.0.10417.20175 or later; Microsoft Office LTSC for Mac 2021, LTSC for Mac 2024, and Office 365 for Mac must be updated to build 16.111.26071215 or later. For Microsoft Office 2019, LTSC 2021 (Windows), LTSC 2024 (Windows), and Microsoft 365 Apps for Enterprise, apply the latest updates via the Office Security Releases page at https://aka.ms/OfficeSecurityReleases - specific Windows build numbers for these products are not independently confirmed from the available data. As a compensating control where immediate patching is delayed, enforce Protected View for files downloaded from the internet or received via email, which prevents automatic parsing of untrusted spreadsheets; note this requires user discipline to not dismiss Protected View prompts. Disabling Excel's handling of legacy XLS formats via Group Policy can reduce parser exposure surface, at the cost of compatibility with older files.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today