EUVD-2026-44228
GHSA-vqrv-f82h-5296
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Local crafted-file open with required user interaction and no privileges (AV:L/UI:R/PR:N); out-of-bounds read yields C:H, and I is N; A set to N as impact is disclosure though vendor rated A:H for possible crash.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Microsoft Excel (across Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) lets an attacker read out-of-bounds heap memory when a victim opens a maliciously crafted spreadsheet, potentially leaking sensitive process memory. The flaw (CWE-125, CVSS 7.1) requires local user interaction and no privileges, but is not remotely triggerable without the user opening the file. There is no public exploit identified at time of analysis, EPSS is low at 0.30%, and CISA SSVC rates exploitation as none.
Technical ContextAI
The vulnerability is an out-of-bounds read (CWE-125) in Excel's file-parsing code, meaning Excel reads memory past the bounds of an allocated buffer while processing a malformed spreadsheet structure (e.g., a crafted record, cell, or object within a workbook). Because the read reaches adjacent heap memory, contents of that memory can be surfaced back through the application, disclosing information the attacker should not access. The affected code is shared across the Office Excel engine, which is why the CPE set spans Windows Office builds (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024), the macOS builds (Office 365/LTSC for Mac), and the server-side Office Online Server rendering component. Root cause is missing or insufficient bounds validation before reading structured document data.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security updates referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55898 and https://aka.ms/OfficeSecurityReleases. Concrete fixed builds include Excel 2016 at 16.0.5561.1001 or later, Office Online Server at 16.0.10417.20175 or later, and the Office for Mac builds at 16.111.26071215 or later; Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 receive the fix through their standard update channels, so ensure automatic updates or your patch-management pipeline (WSUS/Intune/Click-to-Run) deploy the current release. Until patched, reduce exposure by not opening untrusted spreadsheets and enabling Protected View / Office File Block policies for Excel documents arriving from email or the internet, and configure Attack Surface Reduction rules to constrain Office behavior; note that aggressive File Block or disabling document opening can disrupt legitimate workflows, so scope these controls to untrusted sources.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today