CVE-2026-68799: Microsoft 365 Apps Info Disclosure Flaw

CVE-2026-68799 Overview

CVE-2026-68799 is an information disclosure vulnerability in Microsoft Office Excel caused by the use of an uninitialized resource [CWE-908]. An attacker who convinces a local user to open a crafted spreadsheet can read memory contents that were never initialized before use. The flaw affects Microsoft 365 Apps, Excel 2016, Microsoft 365 for macOS, Office 2019, Office LTSC 2021, and Office LTSC 2024 across x86, x64, and macOS builds. Exploitation requires user interaction but no authentication, and it discloses information without impacting integrity or availability. Microsoft addressed the issue through its Security Update Guide advisory for CVE-2026-68799.

Critical Impact

A crafted Excel document can leak process memory contents, potentially exposing sensitive data such as ASLR offsets, document fragments, or credentials residing in the Excel process address space.

Affected Products

• Microsoft 365 Apps (Enterprise, x86 and x64)
• Microsoft Excel 2016 and Microsoft 365 for macOS
• Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (x86, x64, macOS)

Discovery Timeline

• 2026-08-11 - CVE-2026-68799 published to the National Vulnerability Database
• 2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68799

Vulnerability Analysis

The vulnerability is classified as Use of Uninitialized Resource [CWE-908]. Microsoft Excel accesses a memory structure or object field before assigning it a defined value. When Excel serializes or processes portions of a specially crafted workbook, the uninitialized bytes are read and returned to attacker-controllable output paths within the document processing pipeline.

Because the leaked bytes originate from process heap or stack regions, they may contain residual data from previously freed allocations. Attackers commonly use this class of flaw to defeat address space layout randomization (ASLR) or to stage a follow-on memory corruption exploit. The confidentiality impact is rated high, while integrity and availability are unaffected.

Exploitation is local and requires user interaction. The attacker must deliver the malicious .xlsx, .xls, or related Office file through phishing, a file share, or a web download and convince the target to open it in a vulnerable Excel build.

Root Cause

The root cause is a code path in Excel that reads a field or buffer without ensuring it has been fully initialized. A crafted document triggers a parsing branch where allocation occurs but initialization is skipped, causing Excel to operate on stale memory.

Attack Vector

The attack vector is local file opening. The attacker crafts a malicious spreadsheet, delivers it to the victim, and relies on the user opening the file. No elevated privileges are required, and the attacker gains no code execution — only disclosure of memory contents surfaced through document processing.

No public proof-of-concept or exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.345% (27th percentile).

No verified proof-of-concept code is available.
Refer to the Microsoft Security Update Guide for CVE-2026-68799
for authoritative technical details.

Detection Methods for CVE-2026-68799

Indicators of Compromise

• Unsolicited .xlsx, .xlsm, .xls, or .xlsb attachments received via email or downloaded from untrusted sources.
• Excel process (EXCEL.EXE) opening files from temporary internet locations, mail client cache directories, or user download folders shortly after inbound email delivery.
• Anomalous child processes or outbound network requests initiated by Excel following the opening of an untrusted workbook.

Detection Strategies

• Correlate email gateway metadata with endpoint telemetry to identify Excel file opens sourced from external senders that do not match business norms.
• Hunt for Office application versions that predate the vendor patch across the estate using software inventory data.
• Inspect Office documents at the mail and web gateway with content disarm and reconstruction to strip active content and suspicious binary structures.

Monitoring Recommendations

• Enable and forward Microsoft Defender for Office 365 or equivalent Office activity logs, including file open, macro execution, and Protected View events.
• Monitor for unusual memory read patterns and outbound data flows from EXCEL.EXE using EDR process and network telemetry.
• Alert when Excel loads documents from unusual paths such as \AppData\Local\Temp\ immediately after a mail client process writes to those paths.

How to Mitigate CVE-2026-68799

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-68799 across all affected Office SKUs.
• Verify that Microsoft 365 Apps clients are configured to receive updates on the Current or Monthly Enterprise Channel and confirm the patched build is installed.
• Restrict opening of Office documents sourced from the internet by enforcing Protected View and Mark-of-the-Web policies.

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Excel 2016, Microsoft 365 for macOS, Office 2019, Office LTSC 2021, and Office LTSC 2024. Administrators should consult the vendor advisory at msrc.microsoft.com for the specific build numbers and KB identifiers corresponding to each channel and platform.

Workarounds

• Enforce Protected View for files originating from the internet, Outlook attachments, and unsafe locations through Group Policy or Intune administrative templates.
• Use Attack Surface Reduction rules to block Office applications from creating child processes and from injecting into other processes, reducing follow-on exploitation risk.
• Deploy Microsoft Defender Application Guard for Office where supported to isolate untrusted documents in a container.

# Example: enforce Protected View via Group Policy registry keys (Windows)
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV   /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f