CVE-2026-55138: Microsoft 365 Apps Info Disclosure Bug

CVE-2026-55138 Overview

CVE-2026-55138 is an untrusted pointer dereference vulnerability [CWE-822] in Microsoft Office Excel that allows a local, unauthorized attacker to disclose sensitive information. Exploitation requires the target user to open a crafted Excel file, at which point Excel dereferences an attacker-controlled pointer and returns memory contents to the attacker. The flaw affects multiple Office SKUs across Windows and macOS, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Office Online Server. Microsoft published guidance in the Microsoft Security Response Center advisory.

Critical Impact
A crafted Excel workbook can leak process memory contents to an attacker, potentially exposing sensitive data such as document content, credentials in memory, or address information useful for bypassing exploit mitigations.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Excel 2016, Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-55138 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55138

Vulnerability Analysis

The vulnerability is classified as an untrusted pointer dereference [CWE-822] in Microsoft Excel. When Excel parses a specially crafted workbook, code paths inside the file parser dereference a pointer whose value originates from attacker-controlled fields in the document. Because the pointer is not validated against expected memory regions, Excel reads data from an arbitrary address and exposes it through the parsing routine. The confidentiality impact is high while integrity and availability are unaffected, consistent with a pure information disclosure primitive.

Exploitation requires local file handling and user interaction, meaning the victim must open the malicious document. No privileges are required on the target system, and the attack complexity is low.

Root Cause

The root cause is missing validation of a pointer value derived from parsed workbook structures. Excel treats a field inside the document as a trusted memory reference and dereferences it directly. This pattern is characteristic of legacy binary Office formats where record structures embed offsets or indices that should be range-checked before use.

Attack Vector

An attacker crafts a malicious .xls or .xlsx workbook and delivers it through phishing email, file-sharing services, or compromised web pages. When the victim opens the file in a vulnerable Excel client, the parser dereferences the untrusted pointer and returns memory bytes that the attacker can retrieve, for example through embedded formulas, chart references, or callback channels. The disclosed memory can be paired with a separate code execution flaw to defeat Address Space Layout Randomization (ASLR).

No verified public proof-of-concept is available. See the Microsoft CVE-2026-55138 Advisory for vendor technical details.

Detection Methods for CVE-2026-55138

Indicators of Compromise

Inbound email attachments containing Excel workbooks from untrusted senders, particularly files with embedded external references or unusual OLE streams.
EXCEL.EXE processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe shortly after opening an attachment.
Excel processes making outbound network connections to non-Microsoft destinations following document open events.

Detection Strategies

Hunt for Excel process crashes or exception events (Windows Error Reporting entries referencing EXCEL.EXE) that coincide with the opening of externally sourced workbooks.
Correlate Microsoft Office telemetry with endpoint process events to flag workbooks that trigger memory read anomalies or Protected View bypass attempts.
Use YARA rules that inspect Excel documents for malformed BIFF records, oversized offsets, or crafted DrawingML structures known to trigger parser errors.

Monitoring Recommendations

Ingest Microsoft Defender, Office 365, and endpoint logs into a centralized data lake and alert on Excel-originated suspicious child processes or outbound connections.
Monitor mail gateway logs for waves of Excel attachments distributed to multiple recipients within short time windows.
Track Office build versions across the fleet to identify hosts still running vulnerable Excel releases.

How to Mitigate CVE-2026-55138

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-55138 Advisory to all affected Office installations.
Enforce Protected View and Application Guard for Office to isolate workbooks originating from the internet or email.
Block or quarantine inbound Excel attachments from external senders where business justification is absent.

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Microsoft 365 for macOS, and Office Online Server. Administrators should deploy the latest Click-to-Run channel builds or the corresponding MSI security updates listed in the vendor advisory. Office Online Server requires the server-side update package published by Microsoft.

Workarounds

Enable and enforce Protected View for files originating from the internet, unsafe locations, and Outlook attachments.
Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from injecting into other processes.
Restrict opening of legacy binary Excel formats through File Block Settings in Group Policy until patches are deployed.

bash

# Example Group Policy registry settings to enforce Protected View for Excel
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f