Microsoft Office Excel: Out-of-bounds read leads to information disclosure
Summary
An out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. According to Microsoft, an attacker could potentially read small portions of stack memory. User interaction is required, for example by opening a crafted file, and the impact is limited to confidentiality.
Affected
- Microsoft 365 Apps for Enterprise (version ranges unconfirmed, see recommendation)
- Microsoft Office 365 for Mac: versions 1.0.0 to before 16.115.26110837
- Microsoft Office LTSC 2021: versions 16.0.1 to before 16.0.14334.21048
- Microsoft Office LTSC 2024: version ranges unconfirmed (third-party source lists 16.0.0 to before 16.0.17932.21140)
- Microsoft Office LTSC for Mac 2021 and 2024: versions before 16.115.26110837 (unconfirmed)
Fixed in
- Security updates published on November 10, 2026 (per Microsoft release notes)
- Office LTSC 2021: 16.0.14334.21048 (third-party source, unconfirmed)
- Office LTSC 2024: 16.0.17932.21140 (third-party source, unconfirmed)
- Office for Mac and LTSC for Mac: 16.115.26110837 (MSRC page, unconfirmed per product)
Workaround
Unknown.
Exploitation
- No public exploit code known and no exploitation reported by Microsoft as of the sources reviewed.
- CISA SSVC: Exploitation none, automatable no, technical impact partial.
Our recommendation
- Deploy the November 10, 2026 Office security updates to all Microsoft 365 and Office LTSC clients.
- Confirm the fixed build per product on the MSRC page before relying on version numbers, as sources are inconsistent.
- Keep Protected View enabled and avoid opening Excel files from unknown senders until patched.
- Monitor for changes in exploitation status and CVSS rating.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (CVE-2026-111292) msrc.microsoft.com
- CVE Record (CNA) www.cve.org
- Microsoft 365 Apps security updates (release notes) learn.microsoft.com
- Zero Day Initiative November 2026 security update review www.zerodayinitiative.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:31.
Original description (NVD)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.