CVE-2026-45455 Overview
CVE-2026-45455 is an out-of-bounds read vulnerability in Microsoft Office Excel that can disclose memory contents to an attacker. The flaw is classified under [CWE-125] and requires a user to open a crafted file for exploitation. Microsoft documented the issue in its security update guidance and assigned it a low severity rating based on its limited confidentiality impact and lack of integrity or availability effects.
Critical Impact
Successful exploitation discloses small amounts of process memory from Microsoft Office Excel, which can leak sensitive data residing in adjacent memory regions.
Affected Products
- Microsoft Office Excel (see vendor advisory for affected builds)
- Microsoft 365 Apps deployments running Excel
- Versions listed in the Microsoft Security Update Guide
Discovery Timeline
- 2026-06-09 - CVE-2026-45455 published to the National Vulnerability Database
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-45455
Vulnerability Analysis
The vulnerability is an out-of-bounds read in Microsoft Office Excel. When Excel parses a malformed spreadsheet, it reads beyond the bounds of an allocated buffer. The read returns adjacent memory contents to the application, which an attacker can recover through crafted file structures.
The attacker must convince a user to open a malicious document, satisfying the user interaction requirement. Exploitation does not require authentication on the target system. The impact is limited to information disclosure, with no modification of data and no service interruption.
The EPSS model places the probability of exploitation in the next 30 days at 0.054%, in the 17th percentile. No public proof-of-concept code is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is missing or incorrect bounds checking when Excel parses a specific record or structure inside a spreadsheet file. The parser dereferences an offset that extends past the allocated buffer, causing the application to read uninitialized or unrelated process memory.
Attack Vector
An attacker delivers a crafted Excel file through email, web download, or file share. When the victim opens the file in Excel, the parser triggers the out-of-bounds read. The attacker can then exfiltrate the leaked memory by embedding the disclosed bytes into computed cells, external references, or other observable channels.
No synthetic exploit code is provided. Refer to the Microsoft Security Update Guide entry for CVE-2026-45455 for vendor technical details.
Detection Methods for CVE-2026-45455
Indicators of Compromise
- Excel documents arriving from untrusted senders containing malformed BIFF or OOXML records
- Excel processes spawning unexpected child processes after opening attachments
- Outbound network requests from EXCEL.EXE to attacker-controlled hosts following document open events
Detection Strategies
- Inspect inbound email attachments and gateway-uploaded files for malformed Office documents using sandbox detonation
- Alert on Excel processes generating crash, hang, or Watson telemetry shortly after opening attachments
- Correlate document open events with anomalous file reads from user profile directories and temporary Office folders
Monitoring Recommendations
- Forward Microsoft Office telemetry, Windows Defender Application Guard logs, and endpoint process events to a central data lake
- Track patch deployment status for Excel and Microsoft 365 Apps across all managed endpoints
- Monitor user-reported document errors that may indicate attempted exploitation of parsing flaws
How to Mitigate CVE-2026-45455
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all systems running Excel
- Enable Protected View and Office Application Guard for documents originating from the internet and email
- Block or quarantine Excel attachments from untrusted external senders at the email gateway
Patch Information
Microsoft has published a security update addressing CVE-2026-45455. Administrators should consult the Microsoft Security Update Guide for the specific build numbers and KB articles applicable to each supported version of Office and Microsoft 365 Apps.
Workarounds
- Configure Office File Block policy to prevent opening legacy Excel binary formats from untrusted locations
- Enforce Protected View for files originating from the internet, unsafe locations, and Outlook attachments
- Restrict macro execution and external content loading through Group Policy until patches are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
