Microsoft Office Excel: Out-of-bounds read leads to information disclosure
Summary
An out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. According to Microsoft, an attacker could potentially read small portions of heap memory. The attack requires a user to take some action, such as opening a crafted file, and no privileges are needed.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the build referenced at aka.ms/OfficeSecurityReleases (exact fixed build unknown)
- Office LTSC 2021: 16.0.1 before 16.0.14334.20878
- Office LTSC 2024: 16.0.0 before 16.0.17932.20934
- Mac versions: Unknown.
Fixed in
- Microsoft 365 Apps for Enterprise: Unknown. Check the MSRC Security Update Guide or aka.ms/OfficeSecurityReleases.
- Office LTSC 2021: 16.0.14334.20878
- Office LTSC 2024: 16.0.17932.20934
Workaround
- No vendor workaround known. Applying the security update is the fix.
Exploitation
- Not listed in CISA KEV.
- EPSS about 1% (61st percentile), a low predicted likelihood.
- No public proof of concept found.
- No reports of exploitation in the wild found; this could not be confirmed directly.
Our recommendation
- Install the Microsoft 365 Apps and Office LTSC updates in the next regular patch cycle.
- Prioritise systems that open external spreadsheets or receive spreadsheet email attachments.
- Verify installed build numbers against the MSRC table.
- Train users to be cautious with unexpected Excel files.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide msrc.microsoft.com
- threatint CVE record with affected versions cve.threatint.com
- NVD record via Vulners mirror vulners.com
- Rapid7 vulnerability record www.rapid7.com
- VulDB entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 5 Nov 2026, 11:27.
Original description (NVD)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.