CVE-2026-55046 Overview
CVE-2026-55046 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel. An unauthorized attacker can exploit the flaw to disclose sensitive information locally after convincing a user to open a specially crafted spreadsheet. The issue affects multiple supported Office releases, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Office Online Server.
Exploitation requires user interaction, and the attack complexity is low. Successful exploitation leaks memory contents from the Excel process, which may include pointers, heap data, or fragments of other documents useful for chaining with additional vulnerabilities.
Critical Impact
Attackers can leak in-process memory from Excel by luring a user to open a malicious workbook, potentially exposing sensitive data and undermining ASLR for follow-on exploitation.
Affected Products
- Microsoft 365 Apps (Enterprise, x64 and x86)
- Microsoft Excel 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC (Windows and macOS)
- Microsoft Office Online Server
Discovery Timeline
- 2026-07-14 - CVE-2026-55046 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-55046
Vulnerability Analysis
The vulnerability is an out-of-bounds read in Excel's file parsing logic. When Excel processes a malformed spreadsheet, it reads beyond the bounds of an allocated buffer and returns adjacent process memory to the caller. That memory can be reflected into cell contents, error dialogs, or other structures accessible to the attacker's payload.
Because the flaw is limited to reading memory, it does not directly grant code execution. However, disclosed pointers and heap layouts weaken address space layout randomization (ASLR) and often serve as a primer for a paired memory-write vulnerability. The confidentiality impact is high while integrity and availability remain unaffected.
Root Cause
The root cause is missing or incorrect boundary validation when parsing attacker-controlled structures inside an Excel document. Excel trusts a size or index field embedded in the file and dereferences past the end of the underlying buffer. This class of bug is tracked as [CWE-125] Out-of-Bounds Read.
Attack Vector
Exploitation is local and requires user interaction. An attacker crafts a malicious .xlsx, .xls, or related Excel file and delivers it through email, a shared drive, a collaboration platform, or a drive-by download. When the target opens the file, Excel parses the malformed structure and returns memory contents to the attacker-controlled document logic, which can exfiltrate the data through remote resources, macros, or subsequent user actions.
No verified public proof-of-concept code is available for CVE-2026-55046. See the Microsoft CVE-2026-55046 Advisory for vendor technical details.
Detection Methods for CVE-2026-55046
Indicators of Compromise
- Unexpected Excel process crashes or Watson error reports referencing spreadsheet parsing modules.
- Excel workbooks arriving from external senders that contain unusual embedded objects, oversized records, or malformed BIFF/OOXML structures.
- Outbound network connections initiated by EXCEL.EXE shortly after a user opens an attachment, particularly to newly registered or uncategorized domains.
Detection Strategies
- Inspect email gateways and file-sharing platforms for spreadsheets with malformed record sizes or anomalous OLE streams.
- Correlate Office telemetry from Microsoft Defender or equivalent EDR sources with process behavior events for EXCEL.EXE spawning child processes or reaching out to the network.
- Hunt for Excel opening files from Downloads, Temp, or Outlook attachment cache paths followed by data egress within a short time window.
Monitoring Recommendations
- Enable Office cloud protection and Attack Surface Reduction (ASR) rules that block child process creation and Win32 API calls from Office applications.
- Ingest Office and endpoint logs into a centralized data lake to enable retroactive hunting once new indicators are published.
- Alert on Protected View bypasses and Mark-of-the-Web removal on inbound spreadsheets.
How to Mitigate CVE-2026-55046
Immediate Actions Required
- Apply the Microsoft security updates referenced in the Microsoft CVE-2026-55046 Advisory across all affected Office channels, including Office Online Server.
- Confirm that Microsoft 365 Apps devices have received the current monthly update and reboot to complete installation.
- Prioritize patching endpoints belonging to users who routinely process spreadsheets from external parties.
Patch Information
Microsoft has issued fixes through its standard update channels for Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC, the macOS builds of Microsoft 365 and Office LTSC, and Office Online Server. Administrators should validate build numbers against the vendor advisory after deployment.
Workarounds
- Enforce Protected View and Office Application Guard for files originating from the internet and email attachments.
- Block or quarantine legacy Excel binary formats (.xls, .xlsb) at the mail gateway when business need is limited.
- Educate users to avoid opening unsolicited spreadsheets and to report suspicious attachments before opening.
# Example: enforce Protected View for internet-sourced files via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
