CVE-2026-88201: Microsoft Office Excel Information Disclosure Vulnerability
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Other sources
Microsoft Office Excel Information Disclosure Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must induce a user to interact with malicious content in Excel. The vulnerability is network-reachable, requires no attacker privileges, and has low attack complexity, but user interaction is required.
Which Office deployments are identified as affected?
The affected software list includes Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2021 and LTSC 2024 in both 32-bit and 64-bit editions.
What is the likely security impact?
Successful exploitation may disclose information from Excel through a buffer over-read. The supplied metrics indicate high confidentiality impact, with no indicated integrity or availability impact.