CVE-2026-21258: Microsoft Excel Information Disclosure Vulnerability
Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Other sources
Microsoft Excel Information Disclosure Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.5539.1002Patch KB5002837 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.106.26020821 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.10417.20097Patch KB5002835
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21258?
CVE-2026-21258 is classified as an information disclosure vulnerability.
How do I fix CVE-2026-21258?
To fix CVE-2026-21258, ensure you apply the latest security patches provided by Microsoft for affected versions of Excel and Office.
Which Microsoft products are affected by CVE-2026-21258?
CVE-2026-21258 affects several products including Microsoft Excel 2016, Office LTSC 2021, and Microsoft 365 Apps for Enterprise.
What type of threat does CVE-2026-21258 pose to users?
CVE-2026-21258 allows unauthorized attackers to potentially disclose sensitive information on affected systems.
Is there a workaround for CVE-2026-21258?
There are no specific workarounds for CVE-2026-21258; the best solution is to apply the available updates.