EUVD-2026-56457
GHSA-xm9g-6f9f-23pj
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-open trigger (AV:L), no system privileges needed by attacker (PR:N), user must open file (UI:R), impact is memory disclosure only with no write or crash.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read (CWE-125) in Microsoft Excel triggers information disclosure when a victim opens a specially crafted spreadsheet file, exposing potentially sensitive memory contents to a local attacker. The flaw spans multiple Office product lines - Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and corresponding Mac variants - with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified and SSVC confirms no known exploitation; a vendor patch is available via the Microsoft Security Response Center.
Technical ContextAI
The vulnerability is rooted in CWE-125 (Out-of-Bounds Read), a memory safety defect in which Excel's file parser reads data beyond the boundary of an allocated buffer when processing a crafted spreadsheet. Excel's complex binary (XLS) and XML-based (XLSX) format parsers must traverse deeply nested structures, and insufficient boundary validation allows the reader to access adjacent memory regions not intended for the operation. The CVSS local attack vector (AV:L) confirms this is triggered during file open/parse operations rather than over a network protocol. Affected CPE identifiers span Windows-based products - Microsoft Excel 2016 (16.0.x), Office 2019, Office LTSC 2021 and 2024, and Microsoft 365 Apps for Enterprise - as well as macOS variants including Office LTSC for Mac 2021/2024 and Office 365 for Mac. The 'Buffer Overflow' tag alongside CWE-125 may indicate broader memory mishandling in the same parser code path, but the confirmed impact class remains information disclosure. The vulnerability was reported through Microsoft's own security channel (secure@microsoft.com) and is tracked under ENISA EUVD-2026-56457.
RemediationAI
The primary fix is to apply the Microsoft-released security update for each affected product. For Microsoft Excel 2016 on Windows, upgrade to version 16.0.5565.1001 or later. For all macOS Office products - Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office 365 for Mac - upgrade to version 16.112.26081010 or later. For all other Windows-based Office products (Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise), apply updates as directed at https://aka.ms/OfficeSecurityReleases. The full MSRC advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68802. Where immediate patching is not feasible, enable Office Protected View for files originating from external or untrusted sources via Group Policy (Computer Configuration > Administrative Templates > Microsoft Office); note this will prompt users before editing externally-sourced files, creating minor workflow friction. Additionally, consider mail gateway policies that strip or quarantine Excel attachments from unknown senders to reduce the delivery surface.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today