EUVD-2026-99807
GHSA-rj4r-m7h9-33cf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Excel file
-
ExploitDeliver via phishing or download
-
ExecutionUser opens file triggering OOB read
-
ImpactDisclose adjacent process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied, specially crafted Excel file in a vulnerable Office build (Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, or affected Microsoft 365 Apps for Enterprise). The limiting factors are significant: the CVSS vector is local (AV:L) with mandatory user interaction (UI:R), so there is no remote or automatic trigger - the attack fails unless social engineering convinces the user to open the file, and Protected View / Office hardening further reduces realistic exploitability. Impact is limited to information disclosure of adjacent memory (C:H, I:N, A:N); there is no code execution or integrity/availability impact from this flaw alone. |
| Impact | This is a genuinely medium-severity, low-urgency issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) describes local exploitation that requires the victim to open an attacker-crafted file (UI:R), yielding only confidentiality impact (C:H, I:N, A:N) - consistent with an out-of-bounds read (CWE-125) that discloses adjacent memory. All exploitation signals point the same direction and agree: SSVC reports Exploitation=none, Automatable=no, Technical Impact=partial, there is no CISA KEV listing, and no public proof-of-concept is referenced, so the exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so the statistical exploitation probability is unknown and cannot be weighed. The signals are mutually consistent (no conflicts to reconcile): an information-disclosure bug needing user interaction and local access, with a patch already available, is a routine patch-cycle item - not a wormable or mass-exploitable threat. Priority should be driven by the ubiquity of Excel rather than by any active-exploitation signal. |
| Exploit ScenarioDerived | An attacker crafts a malicious Excel spreadsheet and delivers it via phishing email or a download link; when the targeted user opens it, the out-of-bounds read is triggered and leaks fragments of adjacent process memory (potentially including other document data or memory-layout details useful for a follow-on exploit). Because the CVSS vector is local with required user interaction (AV:L/UI:R), success hinges on social engineering the victim into opening the file. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Out-of-bounds memory read in Microsoft Excel allows an attacker to disclose information by convincing a victim to open a specially crafted Excel file with a vulnerable Office build. Affected releases are Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and affected Microsoft 365 Apps for Enterprise builds delivered through the Office security release channel. CISA's SSVC decision framework rates exploitation as none and no public exploit code has been identified at time of analysis; the flaw yields only information disclosure of adjacent memory (C:H, I:N, A:N) with no code execution or availability impact on its own, and exploitation is gated by a local vector (AV:L) plus mandatory user interaction (UI:R).
RemediationAI
Vendor-released patch: Microsoft has published fixes for all three affected channels - update Microsoft Office LTSC 2021 to 16.0.14334.20974 or later, Microsoft Office LTSC 2024 to 16.0.17932.21056 or later, and Microsoft 365 Apps for Enterprise to the current security-channel build listed at https://aka.ms/OfficeSecurityReleases. Guidance and detection details are in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97014). Where patching must be staged, the practical compensating controls are: enforce Protected View and Application Guard for Office for files originating from the internet or email attachments (side effect: users must click 'Enable Editing', adding friction for legitimate macro-free documents), block or quarantine untrusted .xls/.xlsx/.xlsm attachments at the mail and web gateways and preserve Mark-of-the-Web so Protected View engages (side effect: legitimate external spreadsheets are delayed or require an exception workflow), and apply Office Attack Surface Reduction rules that block Office from launching child processes, which does not stop the memory read but limits follow-on activity if a future Office exploit is chained. Because exploitation is local (AV:L) and requires a user to open a crafted file (UI:R), user-awareness and attachment-handling hygiene remain effective secondary controls, and given the SSVC 'Exploitation: none' rating this can be scheduled in a normal patch cycle rather than treated as an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-125 out-of-bounds read in Microsoft Office Excel's file/document parsing code. When Excel parses a structurally malformed or deliberately crafted spreadsheet, a length or offset field is not validated against the actual size of the underlying buffer, so the parser reads past the end of the allocated memory and can surface adjacent heap content into the document or UI. Because the read is out of bounds but not a write, the primitive is disclosure-only - there is no direct path to memory corruption or code execution from this flaw alone, which is consistent with the assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The vector indicates no privilege requirement (PR:N, i.e. unauthenticated in the privilege sense) but a local attack path (AV:L) that requires the target to interact with a file (UI:R), so delivery depends on social engineering rather than remote or automatic triggering; successful exploitation leaks memory contents from the Excel process, which in a local, single-user context tends to have limited value unless the leaked memory contains sensitive document or credential material. The accompanying classification 'Buffer Overflow' should be read as a parser memory-safety defect rather than a writable overflow, and the affected CPE/product family spans the Windows Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise code bases.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
File must be opened locally by the user, so AV:L and UI:R; attacker needs no privileges (PR:N); out-of-bounds read discloses memory only, so C:H with I:N/A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB