CVE-2026-69922: Microsoft 365 Apps Information Disclosure

CVE-2026-69922 Overview

CVE-2026-69922 is an out-of-bounds read vulnerability in Microsoft Office Excel that allows an unauthorized remote attacker to disclose information over a network. The flaw is tracked under CWE-125 and affects Microsoft 365 Apps, Microsoft Office 2021 LTSC, and Microsoft Office 2024 LTSC on both x64 and x86 architectures. Exploitation requires user interaction, typically by convincing a target to open a crafted Excel document. Successful exploitation discloses memory contents from the Excel process to the attacker. Microsoft published advisory details through the Microsoft Security Response Center.

Critical Impact
An attacker can read sensitive memory contents from the Excel process by delivering a malicious spreadsheet, potentially exposing credentials, document contents, or other in-process data.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2021 LTSC (x64 and x86)
Microsoft Office 2024 LTSC (x64 and x86)

Discovery Timeline

2026-10-13 - CVE-2026-69922 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-69922

Vulnerability Analysis

The vulnerability is an out-of-bounds read (CWE-125) in the Excel file parser. When Excel processes a specially crafted spreadsheet, it reads memory beyond the bounds of an allocated buffer. The out-of-bounds data can be reflected into application state accessible to the attacker, producing an information disclosure condition. Impact is limited to confidentiality; integrity and availability are not affected. Exploitation requires the target user to open the malicious file, so delivery relies on phishing, document-sharing platforms, or web-hosted content.

Root Cause

The underlying defect is improper validation of a length, offset, or index value during parsing of structured content inside an Excel document. The parser trusts a size field or record boundary supplied in the file and reads adjacent process memory. Microsoft has not published full technical internals; refer to the Microsoft advisory for authoritative details.

Attack Vector

The attack vector is network-based with required user interaction. An attacker crafts a malicious .xlsx, .xlsm, or related Excel file and delivers it via email attachment, shared link, or compromised web resource. When the victim opens the file in a vulnerable version of Excel, the parser executes the out-of-bounds read and the attacker recovers leaked bytes. No authentication is required on the target system. The EPSS score at publication is 0.835% (56.8 percentile), indicating current exploitation probability is low but non-trivial.

Detection Methods for CVE-2026-69922

Indicators of Compromise

Inbound email containing Excel attachments from untrusted or spoofed senders, especially with uncommon macros or embedded objects.
Excel process (EXCEL.EXE) spawning unusual child processes or performing outbound network connections shortly after opening an attachment.
Unexpected crashes or exception events in EXCEL.EXE logged in the Windows Application event log, which can indicate failed exploitation attempts.

Detection Strategies

Inspect Excel documents at the mail gateway using sandbox detonation to flag files triggering abnormal memory access patterns.
Monitor endpoint telemetry for EXCEL.EXE reading, writing, or transmitting data to unexpected destinations immediately after document open events.
Correlate Office telemetry with user-reported phishing to prioritize investigation of suspicious spreadsheets.

Monitoring Recommendations

Enable Microsoft Office cloud-delivered protection and Attack Surface Reduction (ASR) rules that restrict Office child process creation.
Forward Windows Defender, Office, and EDR events to a central SIEM for correlation across users and tenants.
Track Microsoft 365 Apps update channel compliance to confirm patched builds are deployed across the fleet.

How to Mitigate CVE-2026-69922

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for all affected Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC installations.
Instruct users not to open Excel files from untrusted sources until patching is confirmed.
Verify Microsoft 365 Apps are on a supported update channel and that automatic updates are enforced via group policy or Intune.

Patch Information

Microsoft released fixes through the standard Office servicing channels. Administrators should consult the Microsoft CVE-2026-69922 Advisory for the exact build numbers corresponding to Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC on each architecture. Deploy the updates through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or Configuration Manager.

Workarounds

Enable Protected View for files originating from the internet and from Outlook attachments to open untrusted spreadsheets in a sandbox.
Enforce the Office "Block macros from running in Office files from the Internet" group policy to reduce the delivery surface.
Use mail-flow rules to strip or quarantine Excel attachments from external senders where business justification does not exist.

bash

# Configuration example: enforce Protected View via registry (per-user)
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f