CVE-2026-70328: Microsoft 365 Apps Info Disclosure Flaw

CVE-2026-70328 Overview

CVE-2026-70328 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel that allows an unauthorized attacker to disclose information over a network. The flaw affects parsing logic in Excel when processing malformed spreadsheet content, causing the application to read memory beyond an allocated buffer. Successful exploitation exposes uninitialized process memory that may contain sensitive data such as document fragments, credentials cached in memory, or address information useful for follow-on attacks. Exploitation requires user interaction, typically opening a crafted file delivered by email or hosted on an attacker-controlled resource. Microsoft published the advisory on 2026-08-11 with a CVSS score of 6.5.

Critical Impact
An unauthorized remote attacker can read out-of-bounds memory in Microsoft Excel by convincing a user to open a crafted spreadsheet, leading to disclosure of sensitive in-process data.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016 (x64 and x86)
Microsoft 365 for macOS, Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)

Discovery Timeline

2026-08-11 - CVE-2026-70328 published to NVD
2026-08-11 - Microsoft releases security update via MSRC
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-70328

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Microsoft Excel file parser. When Excel processes a maliciously crafted spreadsheet, a length or index field is trusted without adequate validation. The parser reads memory past the end of a valid buffer and returns that data into a context reachable by the attacker's payload. The attacker does not gain code execution or the ability to modify data. Instead, the flaw discloses adjacent heap or stack contents to the attacker.

The impact profile is limited to confidentiality. Integrity and availability are not affected, consistent with a pure read primitive. Because Excel handles a wide range of embedded object types, spreadsheet formats, and legacy binary structures, out-of-bounds reads in this component often stem from malformed record headers, oversized field descriptors, or inconsistent stream offsets.

Root Cause

The root cause is missing or incorrect bounds checking during deserialization of Excel document structures. A crafted record specifies a size or offset that the parser accepts without verifying against the actual allocation. The parser then dereferences memory outside the intended object, returning stale data from the process address space to the caller.

Attack Vector

Exploitation is network-based but requires user interaction. An attacker delivers a crafted .xlsx, .xls, or related Office document via phishing email, a compromised web page, a shared file service, or a chat platform. When the user opens the file in a vulnerable version of Excel, the parser triggers the out-of-bounds read. Disclosed memory can be exfiltrated back to the attacker through the document itself, for example by embedding the leaked bytes in a formula result or a rendered cell that the attacker can observe.

No public proof-of-concept or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-70328

Indicators of Compromise

Excel documents received from external senders that contain unusually large or malformed records, embedded objects, or references to remote endpoints.
Outbound network connections initiated by EXCEL.EXE shortly after a document open, particularly to previously unseen domains.
Crash telemetry or Windows Error Reporting entries referencing access violations in Excel document parsing modules.

Detection Strategies

Inspect email attachments and file shares for Office documents with anomalous structure using content-aware sandboxing.
Correlate process telemetry for EXCEL.EXE spawning network activity or child processes immediately after opening an attachment.
Hunt across endpoint telemetry for Excel processes generating faults or exception events tied to specific document opens.

Monitoring Recommendations

Enable Office telemetry and forward Microsoft-Office-Alerts and application crash logs to a centralized SIEM for analytics.
Monitor egress from user endpoints for uploads of small payloads that follow the opening of externally sourced spreadsheets.
Track Office version inventory to identify hosts still running unpatched builds of Microsoft 365 Apps, Office 2019, 2021, or 2024.

How to Mitigate CVE-2026-70328

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide for CVE-2026-70328 to all affected Office installations.
Enable Protected View and Office Application Guard for documents originating from the internet or email.
Block or quarantine Office documents received from untrusted external senders at the mail gateway pending inspection.
Educate users to avoid opening unexpected Excel attachments and to report suspicious files.

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Microsoft 365 for macOS, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC. Refer to the Microsoft Security Update CVE-2026-70328 advisory for build numbers and channel-specific guidance. Managed environments should deploy the update through Microsoft Update, Intune, or Configuration Manager and verify installation on all affected endpoints.

Workarounds

Enforce Protected View for files originating from the internet, Outlook attachments, and unsafe locations via Group Policy.
Disable preview handlers for Excel documents in Windows Explorer and Outlook to prevent parsing without explicit user action.
Restrict opening of legacy binary Excel formats (.xls, .xlsb) using File Block Settings until patching is complete.

bash

# Example Group Policy registry keys to enforce Protected View for Excel
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f