CVE-2026-78515 Overview
CVE-2026-78515 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel. The flaw allows an unauthorized attacker to disclose information over a network when a user opens a crafted document. Successful exploitation exposes memory contents that may include sensitive application data.
The issue affects multiple supported Office releases across Windows and macOS, including Microsoft 365 Apps and Office LTSC editions. Exploitation requires user interaction, typically opening a malicious Excel file delivered through email or a web download. No authentication is required on the target system.
Critical Impact
Attackers can trigger memory disclosure in Excel by convincing a user to open a crafted spreadsheet, exposing confidential in-process data across supported Office builds on Windows and macOS.
Affected Products
- Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
- Microsoft Office 2016 and Office 2019 (x64 and x86)
- Microsoft Office LTSC 2021 and Office LTSC 2024 (Windows and macOS)
Discovery Timeline
- 2026-09-08 - CVE-2026-78515 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-78515
Vulnerability Analysis
The vulnerability is an out-of-bounds read within Microsoft Excel's document parsing logic. When Excel processes a specially crafted spreadsheet, it reads memory beyond the bounds of an allocated buffer. The disclosed bytes can be returned through document content, error messages, or otherwise made observable to the attacker.
The flaw impacts confidentiality only. It does not modify data or crash the application in a way that affects availability. Because the attack vector is network-based with required user interaction, delivery through phishing attachments or hosted documents is the expected exploitation path.
Root Cause
The root cause is missing or insufficient bounds validation when Excel parses a structured element inside an Office document format. Excel dereferences an index or offset derived from attacker-controlled fields without verifying that the resulting address lies within the intended buffer. This results in adjacent process memory being read and processed as legitimate document data.
Attack Vector
An attacker crafts a malicious .xlsx, .xls, or related Excel file containing the malformed structure. The file is delivered by email, a link to a shared location, or a compromised website. When the victim opens the file in a vulnerable Excel version, the parser triggers the out-of-bounds read and returns memory contents accessible to the attacker.
No verified public proof-of-concept code is available. See the Microsoft CVE-2026-78515 Advisory for vendor technical details.
Detection Methods for CVE-2026-78515
Indicators of Compromise
- Inbound email attachments containing Excel files (.xlsx, .xlsm, .xls, .xlsb) from untrusted senders, particularly those with unusual embedded structures or oversized records.
- Excel process (EXCEL.EXE) opening documents from temporary internet locations, Outlook attachment cache, or user download directories immediately followed by outbound network connections.
- Crash telemetry or Windows Error Reporting events referencing Excel parsing modules while handling untrusted documents.
Detection Strategies
- Deploy YARA and content-inspection rules on mail gateways to flag Office Open XML files with malformed or oversized BIFF/OOXML records.
- Correlate EXCEL.EXE document-open events with subsequent outbound HTTP or SMB connections that could exfiltrate leaked memory contents.
- Enable Microsoft Defender AV cloud-delivered protection and Attack Surface Reduction (ASR) rules that block Office child-process creation and untrusted executable content.
Monitoring Recommendations
- Alert on Excel opening files originating from Mark-of-the-Web sources without Protected View enforcement.
- Monitor endpoint telemetry for Excel loading unexpected DLLs or spawning scripting hosts such as wscript.exe, powershell.exe, or cmd.exe shortly after document open.
- Track Office version and patch level across the fleet to identify hosts still running vulnerable builds after the security update cycle.
How to Mitigate CVE-2026-78515
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-78515 Advisory to all affected Office and Microsoft 365 Apps installations.
- Enforce Protected View and Office Application Guard for documents originating from the internet or email attachments.
- Inspect and quarantine inbound Excel attachments at the mail gateway pending patch deployment.
Patch Information
Microsoft has issued security updates through the Microsoft Update channel for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024. Administrators should validate patch installation using Click-to-Run version reporting or WSUS/Intune compliance dashboards. Refer to the Microsoft CVE-2026-78515 Advisory for build numbers.
Workarounds
- Configure Group Policy to force Protected View for files from the internet, unsafe locations, and Outlook attachments.
- Block or strip Excel attachments from external senders at the secure email gateway until patches are validated.
- Enable Microsoft Defender ASR rule Block all Office applications from creating child processes to reduce post-exploitation options.
# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
