CVE-2026-44822: Microsoft Excel Information Disclosure Flaw

CVE-2026-44822 Overview

CVE-2026-44822 is an out-of-bounds read vulnerability in Microsoft Office Excel. The flaw allows an unauthorized attacker to disclose information over a network. The weakness is classified under [CWE-125] (Out-of-bounds Read) and is triggered when Excel processes a maliciously crafted spreadsheet. Successful exploitation can expose sensitive memory contents from the Excel process to the attacker.

Critical Impact
A network-based attacker can read out-of-bounds memory from Microsoft Office Excel and exfiltrate sensitive information without authentication or user privileges.

Affected Products

Microsoft Office Excel (refer to the Microsoft CVE-2026-44822 Advisory for impacted builds)

Discovery Timeline

2026-06-09 - CVE-2026-44822 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-44822

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Office Excel. Excel reads memory outside the bounds of an allocated buffer while parsing a crafted spreadsheet structure. The read operation returns data adjacent to the intended buffer, which can include sensitive process memory.

According to the CVSS metrics, the issue produces a high impact on confidentiality and a limited impact on integrity, with no impact on availability. The flaw does not require authentication or user interaction to be triggered remotely.

Root Cause

The root cause is improper validation of an index, offset, or length value during Excel file parsing. The parser dereferences memory past the end of an allocated structure. This behavior matches the [CWE-125] classification for out-of-bounds reads.

Attack Vector

The attack vector is network-based, as indicated by the CVSS metrics. An attacker delivers a crafted Excel document to the target through a network channel such as a web download, file share, or messaging platform. When the malicious document is parsed, Excel reads memory beyond the intended buffer and the leaked contents can be returned to the attacker through document features that reflect parsed data.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the Microsoft CVE-2026-44822 Advisory.

Detection Methods for CVE-2026-44822

Indicators of Compromise

Unexpected Excel process crashes or watchdog events when opening untrusted .xls, .xlsx, or .xlsb files
Inbound emails or shared links delivering Excel documents from untrusted senders followed by outbound network connections from EXCEL.EXE
Excel processes spawning unusual child processes or initiating network connections after opening attachments

Detection Strategies

Hunt for Excel telemetry showing access to malformed spreadsheet structures, abnormal exception handling, or memory access violations
Inspect mail gateways and web proxies for Excel files originating from low-reputation sources and flag those delivered to high-value users
Correlate document open events with subsequent outbound traffic from EXCEL.EXE to non-corporate destinations

Monitoring Recommendations

Monitor endpoint logs for crash dumps tied to EXCEL.EXE and exceptions referencing oart.dll or related Office parsing components
Track Office telemetry for files opened outside Protected View and review Mark-of-the-Web removal events
Alert on Excel making DNS or HTTP requests shortly after opening a document received via email or chat

How to Mitigate CVE-2026-44822

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-44822 Advisory to all Excel installations
Enforce Protected View and Office Application Guard for files originating from the internet or email
Block or sandbox Excel attachments from external senders at the mail gateway until patches are deployed

Patch Information

Microsoft has published guidance for CVE-2026-44822 in the Microsoft Security Response Center advisory. Administrators should consult the advisory for the specific Office build numbers and channels that address the vulnerability and deploy the updates through Microsoft Update, WSUS, Intune, or Configuration Manager.

Workarounds

Enable the File Block policy in Excel to prevent opening legacy spreadsheet formats from untrusted locations
Require Protected View for files from the internet, Outlook attachments, and unsafe locations through Group Policy
Restrict Excel from making outbound network connections through host firewall rules or attack surface reduction policies

bash

# Configuration example: enforce Excel Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\office\16.0\excel\security\protectedview" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\office\16.0\excel\security\protectedview" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\office\16.0\excel\security\protectedview" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f