EUVD-2026-44164
GHSA-jmxw-46f3-mx5p
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Consistent with vendor vector - local file-open required (AV:L), no attacker privileges needed (PR:N), victim must open the crafted file (UI:R), confidentiality impact only with no integrity or availability consequence.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Excel's file parsing engine exposes sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016 through Office LTSC 2024 and Office Online Server across both Windows and macOS platforms. The CVSS vector (AV:L/UI:R/C:H/I:N/A:N) confirms impact is limited to confidentiality loss - no code execution results - and requires local user interaction to trigger. No public exploit has been identified and CISA has not listed this in KEV; with an EPSS of 0.46% and SSVC exploitation status of none, this is appropriate for standard patch cycle prioritization rather than emergency response.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) describes a class of memory safety flaw where a software component reads data from a memory address beyond the allocated buffer boundary, potentially exposing adjacent heap or stack memory to an attacker-influenced output path. In this case, the flaw resides in Microsoft Excel's workbook parsing logic - the component that processes structured spreadsheet record formats such as .xlsx or legacy .xls binary streams. When Excel encounters a specially structured record during file open, the parser advances a read pointer beyond the end of the intended data region. The exposed memory may contain sensitive document contents, recently freed heap data, or internal application state. Affected products confirmed via CPE include: cpe:2.3:a:microsoft:microsoft_excel_2016, cpe:2.3:a:microsoft:microsoft_office_2019, cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_2024, cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, cpe:2.3:a:microsoft:microsoft_office_365_for_mac, cpe:2.3:a:microsoft:microsoft_office_ltsc_for_mac_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_for_mac_2024, and cpe:2.3:a:microsoft:office_online_server. The inclusion of Office Online Server is noteworthy as it implies a potential server-side parsing path depending on how documents are processed in that deployment.
RemediationAI
Apply vendor-released patches via Microsoft Update, Windows Update for Business, or the Microsoft 365 admin center. Confirmed fix versions from EUVD data: Microsoft Excel 2016 must be updated to 16.0.5561.1001 or later; Office Online Server to 16.0.10417.20175 or later; Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024 must reach build 16.111.26071215 or later. For Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024 on Windows, consult https://aka.ms/OfficeSecurityReleases for the current patched build number. As a compensating control pending patching, ensure Excel's Protected View is enabled for files originating from the internet or email attachments (File > Options > Trust Center > Protected View) - this opens untrusted documents in a restricted sandbox that still parses the file but limits what the parser output can reach. Note that Protected View does not prevent the out-of-bounds read from occurring; it reduces the attacker's ability to leverage any disclosed memory. For Office Online Server deployments processing untrusted documents, consider restricting document upload sources or routing uploads through a sandboxed pre-processing tier until the patch is applied.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today