EUVD-2026-56464
GHSA-2c4x-r6q3-f5gj
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-open trigger requires user interaction; no privileges needed from attacker; impact is confidentiality-only with no integrity or availability consequence.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Office Excel exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a victim to open a crafted spreadsheet file. The flaw affects a wide range of Office versions across both Windows and macOS platforms, including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. No public exploit or active exploitation has been identified at time of analysis; SSVC assessment rates exploitation as none and the attack as non-automatable, indicating moderate real-world urgency despite the High confidentiality impact rating.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) arises when Excel's file parsing logic reads beyond the allocated memory buffer while processing a specially crafted spreadsheet. This class of flaw typically occurs in format-specific parsers - such as those handling .xlsx or legacy .xls structures - where insufficient boundary checking allows the application to dereference memory outside the intended data region. The CVSS vector AV:L confirms the vulnerability is triggered locally (i.e., by opening a file), and UI:R confirms a victim must actively interact with the malicious document. Affected CPE strings span both Mac (Office LTSC for Mac 2021 and 2024, Office 365 for Mac) and Windows (Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise), as confirmed by the EUVD affected-version listing. The scope is unchanged (S:U), limiting the blast radius to the Excel process itself.
RemediationAI
Apply the vendor-released patch immediately via Microsoft Update or manual deployment. For macOS installations of Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office 365 for Mac, upgrade to build 16.112.26081010 or later. For Windows-based Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise, apply the security update detailed at https://aka.ms/OfficeSecurityReleases - exact build numbers are not independently confirmed from the provided input data and should be verified against that page directly. As a compensating control prior to patching, organizations can configure Protected View to open all externally sourced documents in read-only sandbox mode (enabled by default in most enterprise Group Policy baselines), which can prevent the vulnerable parsing code path from being triggered for files received via email or downloaded from the internet. Disabling macro-enabled content or enforcing WDAC/AppLocker policies on Office does not mitigate this specific parsing flaw but reduces the broader attack surface. No workaround eliminates the risk as effectively as patching.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today