CVE-2026-68797: Microsoft 365 Apps Info Disclosure Flaw

CVE-2026-68797 Overview

CVE-2026-68797 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel. The flaw allows an unauthorized attacker to disclose information locally when a user opens a specially crafted spreadsheet. Exploitation requires user interaction but no prior authentication.

The vulnerability affects multiple supported Office releases including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC across Windows x86, x64, and macOS platforms. Microsoft published the advisory on 2026-08-11. The Exploit Prediction Scoring System (EPSS) rates the probability of exploitation at 0.447% (37th percentile).

Critical Impact
Successful exploitation permits an attacker to read memory contents outside the intended buffer, potentially exposing sensitive process data such as heap layout information, document content, or ASLR-relevant pointers.

Affected Products

Microsoft 365 Apps (x86 and x64 Enterprise), and Microsoft 365 for macOS
Microsoft Excel 2016, Office 2016, Office 2019 (x86/x64)
Microsoft Office 2021 LTSC and Office 2024 LTSC (x86, x64, macOS)

Discovery Timeline

2026-08-11 - CVE CVE-2026-68797 published to NVD
2026-08-11 - Microsoft releases security advisory and patch
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68797

Vulnerability Analysis

The issue is classified as an out-of-bounds read [CWE-125] in the Excel file parsing logic. When Excel processes a malformed spreadsheet, it reads memory past the boundary of an allocated buffer. The attacker controls the crafted file structure, which drives the parser into an unintended read region.

Because the read occurs during document processing, disclosed bytes can flow into cell values, error messages, or internal structures that an attacker later reconstructs. The vulnerability does not modify memory and does not directly grant code execution. However, disclosed pointer or heap metadata frequently accelerates chained exploitation with a companion memory corruption bug.

Exploitation is confined to the local attack surface. The attacker must deliver a malicious .xlsx, .xls, or related Excel document and convince a user to open it. Preview handlers and automatic content extraction paths can also trigger the vulnerable code without an explicit open action.

Root Cause

Out-of-bounds reads in Office parsers typically stem from missing or incorrect length validation on attacker-controlled record fields. Microsoft has not published low-level technical details for CVE-2026-68797. Refer to the Microsoft CVE-2026-68797 Advisory for the authoritative description.

Attack Vector

The attack vector is local with required user interaction. Common delivery methods include phishing emails carrying weaponized attachments, links to documents hosted on attacker-controlled file shares, and USB-based document delivery. Confidentiality is impacted while integrity and availability are not.

The vulnerability yields no verified public proof-of-concept exploit and is not listed on the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft CVE-2026-68797 Advisory for vendor-published detection guidance.

Detection Methods for CVE-2026-68797

Indicators of Compromise

Unexpected Excel process crashes or Windows Error Reporting entries referencing EXCEL.EXE and access violations during document open.
Excel spawning unusual child processes or performing outbound network requests immediately after opening an attachment.
Inbound email attachments with Excel file extensions from untrusted senders, especially with embedded external references or unusual record streams.

Detection Strategies

Hunt for anomalous Excel telemetry: process crashes, unhandled exceptions, and unexpected memory reads sourced from user-opened documents.
Correlate document open events with subsequent process behavior, file writes to %TEMP%, or clipboard access that could exfiltrate leaked memory content.
Apply email gateway inspection rules for Excel files containing malformed BIFF records or unusual OLE structures.

Monitoring Recommendations

Enable and forward Microsoft Office telemetry and Windows event logs to a centralized SIEM for behavioral analysis.
Monitor Attack Surface Reduction (ASR) rule triggers, particularly rules that block Office child processes and Win32 API calls from macros.
Track patch deployment coverage across all Office SKUs listed in the advisory to identify unpatched endpoints.

How to Mitigate CVE-2026-68797

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-68797 Advisory across all affected Office channels.
Prioritize patching of endpoints handling external documents, including finance, procurement, and executive assistant workstations.
Enforce email attachment scanning and block or sandbox Excel files from untrusted senders until patching is confirmed.

Patch Information

Microsoft has released fixes through its standard update channels for Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC on both Windows and macOS. Consult the Microsoft CVE-2026-68797 Advisory for build numbers and update package identifiers specific to each channel.

Workarounds

Enable Protected View for files originating from the internet and other untrusted locations.
Disable the Windows Explorer preview pane for Office file types to prevent parsing prior to user action.
Configure Group Policy to block Office file types from executing embedded content and to enforce File Block settings for legacy Excel formats.

bash

# Configuration example: Enforce Protected View via Group Policy registry keys (Windows)
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f

# Disable preview handlers for Office documents
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowPreviewHandlers /t REG_DWORD /d 0 /f