CVE-2026-21261: Microsoft 365 Apps Info Disclosure Flaw

CVE-2026-21261 Overview

CVE-2026-21261 is an out-of-bounds read vulnerability affecting Microsoft Office Excel that allows an unauthorized attacker to disclose sensitive information locally. This memory corruption flaw occurs when Excel improperly reads data beyond the bounds of an allocated buffer, potentially exposing sensitive information stored in adjacent memory regions.

Critical Impact

Attackers can exploit this vulnerability to leak sensitive data from memory when a user opens a specially crafted Excel file, potentially exposing confidential information, credentials, or data that could facilitate further attacks.

Affected Products

• Microsoft 365 Apps (Enterprise x64/x86)
• Microsoft Excel 2016 (x64/x86)
• Microsoft Office 2019 (x64/x86)
• Microsoft Office Long Term Servicing Channel 2021/2024 (Windows and macOS)
• Microsoft Office Online Server

Discovery Timeline

• February 10, 2026 - CVE-2026-21261 published to NVD
• February 11, 2026 - Last updated in NVD database

Technical Details for CVE-2026-21261

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory corruption flaw that occurs when software reads data past the end or before the beginning of an intended buffer. In the context of Microsoft Excel, this vulnerability manifests when the application processes specially crafted spreadsheet files that trigger improper memory access operations.

The out-of-bounds read condition allows attackers to access memory contents beyond what should be permissible, leading to information disclosure. While this vulnerability requires local access and user interaction (opening a malicious file), the potential for exposing sensitive information from memory makes it a significant security concern for enterprise environments.

Root Cause

The root cause stems from insufficient boundary validation when Excel processes certain file structures or data elements. The application fails to properly verify that memory read operations remain within the bounds of allocated buffers, allowing read access to adjacent memory regions. This type of vulnerability typically occurs in parsing routines that handle complex file formats where size or length fields may be manipulated to cause the application to read beyond intended boundaries.

Attack Vector

Exploitation requires local access and user interaction. An attacker would need to craft a malicious Excel file designed to trigger the out-of-bounds read condition when opened by a victim. The attack scenario typically involves:

1. Creating a specially crafted .xlsx or .xls file containing malformed data structures
2. Delivering the malicious file to the target via email, file sharing, or other means
3. Convincing the user to open the file in a vulnerable version of Microsoft Excel
4. Upon opening, the vulnerability triggers and sensitive memory contents may be disclosed

The disclosed information could include heap memory contents, potentially revealing sensitive data, memory addresses useful for bypassing ASLR, or other information that could facilitate additional attacks.

Detection Methods for CVE-2026-21261

Indicators of Compromise

• Unusual Excel crashes or unexpected behavior when opening spreadsheet files from unknown sources
• Excel process accessing memory regions outside normal operational boundaries
• Suspicious .xlsx or .xls files with abnormal internal structures or malformed XML components
• Memory access violations logged by endpoint protection solutions

Detection Strategies

• Deploy endpoint detection and response (EDR) solutions to monitor Excel process memory operations for anomalous read patterns
• Implement file analysis sandboxing to inspect Excel documents before delivery to end users
• Enable Windows Event logging for application crashes and memory access violations related to Excel processes
• Utilize SentinelOne's behavioral AI to detect exploitation attempts targeting memory corruption vulnerabilities

Monitoring Recommendations

• Monitor for Excel application crashes that may indicate exploitation attempts
• Track the opening of Excel files from untrusted sources or external email attachments
• Implement alerting for memory access anomalies in Microsoft Office processes
• Review endpoint telemetry for patterns consistent with information disclosure attacks

How to Mitigate CVE-2026-21261

Immediate Actions Required

• Apply the latest Microsoft security updates for all affected Office products immediately
• Enable Protected View in Microsoft Excel to prevent automatic execution of potentially malicious content
• Educate users about the risks of opening Excel files from unknown or untrusted sources
• Implement email security controls to scan and quarantine suspicious Office attachments

Patch Information

Microsoft has released security updates to address this vulnerability. Organizations should apply the relevant patches through Windows Update, Microsoft Update Catalog, or enterprise deployment tools such as WSUS or Microsoft Endpoint Configuration Manager. Refer to the Microsoft Security Update Guide for CVE-2026-21261 for detailed patch information and download links for specific product versions.

Workarounds

• Enable Protected View for files originating from the Internet and untrusted locations in Excel Trust Center settings
• Block Excel files from external sources at the email gateway or web proxy level until patches can be applied
• Use Microsoft Office's Application Guard feature where available to isolate potentially malicious documents
• Restrict users from opening Office documents from untrusted network locations through Group Policy

# PowerShell: Enable Protected View for Internet files in Excel via registry
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableAttachmentsInPV" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value 0 -Type DWord