CVE-2026-48580: Microsoft 365 Apps Disclosure Vulnerability

CVE-2026-48580 Overview

CVE-2026-48580 is an untrusted pointer dereference vulnerability in Microsoft Office Excel that allows a local, unauthorized attacker to disclose sensitive information. The flaw is tracked under CWE-822: Untrusted Pointer Dereference and requires user interaction to trigger, typically by opening a crafted Excel document. Successful exploitation exposes memory contents from the Excel process, which can include cached data, credentials, or address information useful for follow-on attacks. Microsoft published the advisory on July 14, 2026, and the vulnerability affects multiple supported versions of Excel and Office across Windows and macOS.

Critical Impact
A crafted Excel file can cause Excel to dereference an attacker-controlled pointer, leaking process memory contents to a local attacker with the ability to deliver the file to a user.

Affected Products

Microsoft 365 Apps for Enterprise (x64 and x86)
Microsoft Excel 2016, Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024
Microsoft 365 for macOS and Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-48580 published to the National Vulnerability Database
2026-07-14 - Microsoft published the security update guide entry
2026-07-15 - Last updated in the NVD database

Technical Details for CVE-2026-48580

Vulnerability Analysis

The vulnerability is an untrusted pointer dereference within Microsoft Office Excel. Excel reads a value from a crafted spreadsheet and uses it as a pointer without validating that it references legitimate program memory. When the dereference occurs, Excel reads from an attacker-influenced memory address and returns data through the application interface or file output. The result is an information disclosure primitive scoped to the Excel process. The attack is local and requires the victim to open a malicious document, but no privileges are needed on the target system.

Root Cause

The root cause is improper validation of a pointer value parsed from spreadsheet content, categorized as CWE-822. Excel treats a field within the file as a trusted pointer and performs a read operation against it. Because the value originates from untrusted input, the attacker controls the source address of the read.

Attack Vector

An attacker crafts an Excel workbook containing malformed structures that place attacker-controlled data into a field Excel later dereferences as a pointer. The file is delivered through email attachments, shared drives, or web downloads. When the victim opens the file in a vulnerable Excel version, Excel dereferences the pointer and exposes memory contents. Because the confidentiality impact is high while integrity and availability are unaffected, the vulnerability is best suited for reconnaissance, memory disclosure, and address-space leaks that support chained exploits.

No public proof-of-concept code is available at the time of publication. See the Microsoft advisory for CVE-2026-48580 for authoritative technical details.

Detection Methods for CVE-2026-48580

Indicators of Compromise

Excel workbook files (.xls, .xlsx, .xlsm, .xlsb) delivered from untrusted senders that trigger crashes or unusual read patterns in EXCEL.EXE
Unexpected outbound network activity from Excel following the opening of a suspicious document
Office telemetry showing repeated abnormal termination of Excel across users receiving the same attachment

Detection Strategies

Inspect email gateways and file shares for Excel documents containing malformed OLE, BIFF, or OOXML structures that reference invalid offsets
Correlate document open events with process memory read anomalies and child process creation from EXCEL.EXE
Hunt for Excel workbooks arriving from external senders that immediately follow spearphishing patterns targeting finance or executive users

Monitoring Recommendations

Enable Microsoft 365 Defender or equivalent telemetry to capture Office application crashes and exception events
Log document provenance using Mark-of-the-Web enforcement and alert on protected view bypass attempts
Retain Excel process telemetry, including module loads and file reads, for retrospective hunting against future indicators

How to Mitigate CVE-2026-48580

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-48580 to all affected Excel and Office installations
Prioritize patching endpoints used by users who routinely handle external spreadsheets, such as finance, procurement, and executive assistants
Reinforce user awareness about opening unexpected Excel attachments, particularly from external senders

Patch Information

Microsoft has released updates addressing CVE-2026-48580 for Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft 365 for macOS, and Office Online Server. Administrators should deploy updates through Microsoft Update, WSUS, Intune, or the Click-to-Run channel appropriate for their environment. Verify build numbers after deployment against Microsoft's published fixed versions.

Workarounds

Enforce Protected View and Office Application Guard for files originating from the internet or email
Block or quarantine Excel attachments from untrusted external sources at the email gateway until patches are deployed
Disable legacy file format support where business processes allow, reducing the parser surface exposed to malformed documents

bash

# Enforce Protected View for files from the internet via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f