CVE-2026-72974: Microsoft 365 Apps Information Disclosure

CVE-2026-72974 Overview

CVE-2026-72974 is a buffer over-read vulnerability in Microsoft Office Excel that allows an unauthorized attacker to disclose information over a network. The flaw is tracked under CWE-126: Buffer Over-read and affects multiple supported Office releases across Windows and macOS. Exploitation requires a user to open a crafted Excel document, after which the parser reads memory beyond an allocated buffer and returns unintended data to the attacker.

Critical Impact
Successful exploitation exposes sensitive process memory from Excel, which may include document contents, session data, or fragments useful for chaining into higher-impact attacks.

Affected Products

Microsoft 365 Apps for Enterprise (x86 and x64)
Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS where applicable)

Discovery Timeline

2026-09-08 - CVE-2026-72974 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72974

Vulnerability Analysis

The vulnerability resides in Excel's document parsing logic, where the application reads past the end of a buffer while processing a crafted spreadsheet file. Buffer over-reads occur when code trusts an attacker-controlled length or index field without validating it against the true size of the underlying allocation. The disclosed bytes originate from adjacent heap memory in the Excel process and can contain any data that the process has recently handled.

Because the attack vector is network-based but requires user interaction, delivery typically occurs through phishing emails carrying a malicious .xlsx, .xls, or .xlsb attachment, or via a link to a document hosted on an attacker-controlled site. No privileges are required on the target system.

Root Cause

The root cause is missing or insufficient bounds checking on a length or offset value inside an Excel record structure. When Excel parses the malformed record, the read operation extends beyond the allocated buffer boundary, returning uninitialized or unrelated process memory into a field that the attacker can later observe.

Attack Vector

An attacker crafts an Excel file containing a malformed structure that triggers the over-read. The file is delivered to the victim over a network channel such as email, a messaging platform, or a web download. When the victim opens the file in a vulnerable Excel version, sensitive memory contents are leaked to the attacker through document artifacts or telemetry the attacker can retrieve.

No verified public proof-of-concept code is available for CVE-2026-72974. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-72974

Indicators of Compromise

Inbound email attachments containing Excel workbooks from untrusted senders, particularly with unusual or malformed record structures.
Excel processes (EXCEL.EXE) opening documents originating from the Internet zone or Mark-of-the-Web tagged files.
Outbound network connections initiated shortly after opening a spreadsheet, indicating potential exfiltration of leaked memory.

Detection Strategies

Inspect Office telemetry for Excel crashes or exception events tied to document parsing, which can indicate probing attempts.
Correlate email gateway logs with endpoint file-open events to identify weaponized attachments delivered by phishing campaigns.
Apply YARA or content inspection rules on mail flow to flag Excel documents with anomalous BIFF or OOXML record sizes.

Monitoring Recommendations

Monitor Excel child-process activity and unexpected DLL loads that could accompany chained exploitation.
Track user-reported document rendering errors, which may indicate malformed files targeting the parser.
Ensure endpoint EDR telemetry captures process command lines, file provenance, and network activity from Office applications.

How to Mitigate CVE-2026-72974

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-72974 to all affected Office installations.
Prioritize patching for users who routinely handle external spreadsheets, including finance, procurement, and executive assistants.
Enforce Protected View and Mark-of-the-Web for documents received from email or the Internet.

Patch Information

Microsoft has issued fixes through the Microsoft Update channel for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC. Consult the Microsoft Security Update Guide for the specific build numbers that resolve the buffer over-read.

Workarounds

Block or quarantine Excel attachments from untrusted external senders at the mail gateway until patches are deployed.
Configure Group Policy to enforce Protected View for files originating from the Internet, unsafe locations, and Outlook attachments.
Disable preview handlers for Excel documents in mail clients and file explorers to reduce accidental exposure.

bash

# Enforce Excel Protected View via Group Policy registry keys (Windows)
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f