CVE-2026-68802: Microsoft 365 Apps Info Disclosure Bug

CVE-2026-68802 Overview

CVE-2026-68802 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel that allows a local, unauthenticated attacker to disclose sensitive information. Exploitation requires user interaction, typically opening a crafted Excel document. The flaw affects a broad range of Microsoft Office releases, including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021, and Office 2024 across Windows and macOS platforms.

Critical Impact
Successful exploitation can leak process memory contents from Excel, potentially exposing sensitive workbook data or memory addresses useful for chaining with other vulnerabilities.

Affected Products

Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
Microsoft Excel 2016, Office 2019, Office 2021 LTSC (Windows and macOS)
Microsoft Office 2024 LTSC (Windows and macOS)

Discovery Timeline

2026-08-11 - CVE-2026-68802 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68802

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in Microsoft Office Excel. Excel reads memory beyond the intended buffer boundaries while parsing a crafted spreadsheet, returning adjacent process memory to attacker-influenced code paths. The result is local information disclosure with no impact on integrity or availability.

The attack vector is local and requires user interaction. An attacker must deliver a malicious Excel file — typically via email, a shared drive, or a download — and convince a user to open it. Because privileges are not required, any user session that opens the file is sufficient to trigger the read.

Disclosed memory contents may include fragments of other open documents, cached credentials in Excel's address space, or pointers useful for bypassing Address Space Layout Randomization (ASLR) when chained with a memory corruption bug.

Root Cause

The root cause is missing or insufficient bounds validation on a buffer read operation within Excel's file parsing logic. When Excel processes a specially crafted structure inside a spreadsheet, the parser calculates an offset or length that exceeds the buffer's allocated size and reads unrelated adjacent memory.

Attack Vector

An attacker crafts a malicious .xls, .xlsx, or related Excel file containing malformed structures that trigger the out-of-bounds read. The file is delivered to the target through phishing, a compromised web page, or a shared network location. When the victim opens the document in a vulnerable Excel version, the parser dereferences beyond the intended bounds and the leaked bytes become accessible to attacker-controlled logic inside the document, such as embedded formulas or macros. See the Microsoft CVE-2026-68802 Advisory for vendor technical details.

Detection Methods for CVE-2026-68802

Indicators of Compromise

Excel documents originating from external or untrusted senders that contain malformed BIFF, OOXML, or embedded object structures
Unexpected EXCEL.EXE crashes, Watson error reports, or Windows Error Reporting entries tied to memory access violations during document open
Excel spawning outbound network connections or child processes shortly after a document is opened

Detection Strategies

Inspect inbound email attachments and file-share uploads for Excel documents with anomalous structure using content disarm and reconstruction or sandbox detonation
Correlate EXCEL.EXE faulting-module telemetry with recent document-open events on the same host
Hunt for Excel processes reading memory regions immediately followed by encoded data exfiltration via HTTP, DNS, or clipboard operations

Monitoring Recommendations

Enable Microsoft Office telemetry and Attack Surface Reduction (ASR) rules that log child-process creation and Win32 API calls from Office applications
Forward endpoint process, file, and network telemetry to a centralized data lake for retrospective hunting against new indicators
Alert on Excel processes accessing credential stores, LSASS, or memory of unrelated processes after document open

How to Mitigate CVE-2026-68802

Immediate Actions Required

Apply the security updates referenced in the Microsoft CVE-2026-68802 Advisory to all affected Office and Microsoft 365 Apps installations
Enforce Protected View and Block Macros From the Internet policies for Excel across managed endpoints
Restrict opening of Excel files received from external senders until patching is complete

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC on both Windows and macOS. Administrators should deploy the latest cumulative update via Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or the Microsoft 365 Apps update channel. Verify update installation by checking the Excel File > Account > About Excel build number against the fixed version listed in the vendor advisory.

Workarounds

Configure Excel to open files from the internet in Protected View and disable editing until reviewed
Use File Block policy via Group Policy to prevent Excel from opening legacy binary formats from untrusted locations
Deliver phishing awareness training that emphasizes the risk of opening unsolicited spreadsheet attachments

bash

# Example Group Policy registry keys to enforce Protected View for Excel
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f