CVE-2026-55122 Overview
CVE-2026-55122 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel. An unauthorized attacker can exploit this flaw to disclose information locally when a user opens a specially crafted Excel file. The vulnerability affects multiple Microsoft Office and Microsoft 365 products across Windows and macOS platforms. Exploitation requires user interaction, typically opening a malicious spreadsheet delivered through email or a web download. Successful exploitation can leak memory contents from the Excel process, potentially exposing sensitive data used in other operations.
Critical Impact
Attackers can read out-of-bounds memory in Excel to disclose sensitive information and cause process termination, requiring only that a user open a crafted spreadsheet.
Affected Products
- Microsoft 365 Apps (Enterprise x64 and x86)
- Microsoft Excel 2016, Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (Windows and macOS)
- Microsoft 365 for macOS and Microsoft Office Online Server
Discovery Timeline
- 2026-07-14 - CVE-2026-55122 published to the National Vulnerability Database (NVD)
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-55122
Vulnerability Analysis
CVE-2026-55122 is classified as an out-of-bounds read [CWE-125] in Microsoft Office Excel. The vulnerability allows an attacker to read memory beyond the intended buffer boundaries while Excel parses a maliciously crafted file. This condition can expose adjacent heap or stack memory to an attacker, disclosing data such as pointers, document contents, or other in-process information. The impact scope includes both confidentiality and availability, since the same condition can also cause the Excel process to crash.
Root Cause
The root cause is improper validation of the size or index used when reading structured data from an Excel document. When Excel processes crafted records, it reads outside the bounds of an allocated buffer. This behavior is consistent with parser-level trust in attacker-controlled length or offset fields within the file format.
Attack Vector
The attack vector is local and requires user interaction. An attacker crafts a malicious .xlsx, .xls, or related Excel document and delivers it through email, a file share, or a web download. When the victim opens the file, Excel triggers the out-of-bounds read during parsing. Because the vulnerability affects Office Online Server as well, server-side document rendering paths may also process attacker-supplied content. No authentication is required on the target system for the exploit to succeed.
No public proof-of-concept code has been published for CVE-2026-55122. See the Microsoft CVE-2026-55122 Advisory for vendor technical details.
Detection Methods for CVE-2026-55122
Indicators of Compromise
- Excel process (EXCEL.EXE) crashes or Windows Error Reporting entries generated shortly after opening a spreadsheet from an untrusted source.
- Inbound emails or downloads delivering Excel files with anomalous internal structures, oversized records, or malformed OLE streams.
- Excel spawning unexpected child processes or performing outbound network connections immediately after opening a document.
Detection Strategies
- Inspect Office telemetry and Protected View bypass events for spreadsheets originating from external sources.
- Correlate email gateway logs with endpoint file-open events to identify weaponized .xlsx, .xlsm, or .xlsb attachments.
- Apply YARA or content inspection rules against Excel documents containing malformed BIFF or OOXML records associated with parser abuse.
Monitoring Recommendations
- Monitor endpoints for repeated Excel crashes, faulting module entries referencing Office DLLs, and abnormal memory access patterns.
- Track Office Online Server request logs for uploads of untrusted spreadsheets and rendering failures.
- Alert on Excel processes reading sensitive files or accessing credential stores immediately after opening a document.
How to Mitigate CVE-2026-55122
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-55122 Advisory to all affected Office and Microsoft 365 installations.
- Prioritize patching for shared workstations, VDI environments, and Office Online Server instances that process external documents.
- Verify update status across Windows and macOS Office deployments through your patch management console.
Patch Information
Microsoft has issued fixes for the affected products through its standard update channels. Refer to the Microsoft CVE-2026-55122 Advisory for the specific build numbers, Click-to-Run channels, and update packages that address this vulnerability across Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office Online Server.
Workarounds
- Enforce Protected View and Office File Block policies for Excel documents received from the internet or email.
- Disable Excel file previewing in Outlook and Windows Explorer on unpatched systems to reduce inadvertent exposure.
- Restrict opening of Excel documents from untrusted sources through Attack Surface Reduction (ASR) rules and email attachment filtering.
# Example: enable Protected View via Group Policy registry keys on Windows
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
