Microsoft Office Excel: Remote Code Execution via out-of-bounds read
Summary
Microsoft Office Excel contains an out-of-bounds read vulnerability (CWE-125) that allows remote code execution. An unauthenticated attacker can send a crafted Excel file over the network, and the attack requires that a user opens or previews the file. Microsoft and NVD rate it CVSS 8.8 (High). CISA SSVC data reports no known exploitation.
Affected
- Microsoft 365 Apps for Enterprise (16.0, 32- and 64-bit)
- Microsoft Office 365 for Mac: 1.0.0 before 16.114.26101123
- Microsoft Office LTSC 2021: 16.0.1 before 16.0.14334.20974 (version threshold from aggregator, unverified)
- Microsoft Office LTSC 2024: 16.0.0 before 16.0.17932.21056 (version threshold from aggregator, unverified)
Fixed in
- Security updates are listed on the MSRC advisory. Confirm exact builds per product on the MSRC page before rollout.
- Windows editions: MSRC links an update for Office LTSC 2024 (64-bit) and lists release date October 13, 2026 for the other editions.
- Office LTSC for Mac 2021 and 2024: no fix available yet. Microsoft will notify customers when updates are released.
Workaround
- No workaround is documented in the retrieved sources.
- Keep Protected View and attachment blocking enabled.
- Filter or sandbox inbound Excel files from external senders.
- Restrict the Outlook preview pane for untrusted mail where practical.
Exploitation
- CISA SSVC: exploitation none, automatable no.
- Microsoft rates exploit code maturity as Unproven (E:U).
- No public proof of concept found in the research. Not listed in CISA KEV at the time of research.
Our recommendation
- Patch Microsoft 365 Apps and Office LTSC installations on the next cycle, prioritising mail-facing systems and unpatched installs.
- Verify exact fixed builds on the MSRC page and check your Office build numbers.
- Isolate Office for Mac LTSC systems from untrusted files until a fix is released.
- Limit Excel files from external senders and monitor for suspicious attachments.
- Re-check CISA KEV and exploit status before the next patch review.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC advisory CVE-2026-70254 msrc.microsoft.com
- OpenCVE CVE-2026-70254 app.opencve.io
- ZDI October 2026 security update review www.zerodayinitiative.com
- Strix CVE-2026-70254 (third-party version data) www.strix.ai
- VulDB entry 418697 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:51.
Original description (NVD)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.