CVE-2026-81390: Microsoft 365 Apps Information Disclosure

CVE-2026-81390 Overview

CVE-2026-81390 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel. The flaw allows an unauthorized attacker to disclose information locally when a user opens a crafted Excel file. Exploitation requires user interaction, such as opening a malicious spreadsheet delivered by email or download. The vulnerability affects multiple Microsoft Office and Microsoft 365 releases across Windows and macOS platforms.

Critical Impact
Successful exploitation exposes sensitive process memory contents from Excel, which attackers can use to bypass mitigations or harvest data for follow-on attacks.

Affected Products

Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
Microsoft Excel 2016, Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2026-09-08 - CVE-2026-81390 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81390

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] within Microsoft Excel's file parsing logic. When Excel processes a malformed spreadsheet, it reads memory beyond the bounds of an allocated buffer. The disclosed memory can contain heap contents, pointers, or fragments of previously processed data. An attacker who controls the crafted file can influence which memory regions are read and returned to the parsing routine.

Attackers typically use out-of-bounds reads to leak Address Space Layout Randomization (ASLR) offsets. That information is then chained with a separate memory-corruption bug to achieve code execution. Standalone, the bug enables information disclosure only, with no direct impact on integrity or availability.

Root Cause

The root cause is missing or insufficient bounds checking when Excel parses a specific record or structure within a spreadsheet file. Microsoft has not published low-level technical details. See the Microsoft Security Update Guide for advisory information.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious Excel document and delivers it through phishing, a shared file location, or a drive-by download. Exploitation begins when the user opens the file in a vulnerable Excel version. No elevated privileges are required on the target system.

No verified proof-of-concept code is publicly available for CVE-2026-81390.
Refer to the Microsoft Security Update Guide for advisory details.

Detection Methods for CVE-2026-81390

Indicators of Compromise

Unexpected Excel process crashes or Windows Error Reporting entries referencing EXCEL.EXE shortly after a document is opened.
Excel spawning unusual child processes such as powershell.exe, cmd.exe, or rundll32.exe, which may indicate this bug being chained with a second vulnerability.
Inbound emails carrying .xls, .xlsx, .xlsm, or .xlsb attachments from untrusted senders with unusual macro or external data content.

Detection Strategies

Hunt for Excel opening files from %TEMP%, Downloads, or Outlook temporary directories followed by anomalous network connections.
Correlate Office telemetry with EDR process events to identify parser crashes coinciding with document open activity.
Apply YARA rules on mail gateways to flag Excel files containing malformed BIFF or OOXML records associated with parsing anomalies.

Monitoring Recommendations

Enable Microsoft Defender for Office 365 Safe Attachments and detonation for inbound spreadsheets.
Forward Office AlertUserOn and application crash telemetry to a central SIEM for correlation.
Monitor for privilege escalation or credential access activity following Excel document opens on high-value endpoints.

How to Mitigate CVE-2026-81390

Immediate Actions Required

Apply the September 2026 Microsoft security updates referenced in the Microsoft Security Update Guide to all affected Office and Microsoft 365 installations.
Prioritize patching endpoints used by finance, executive, and administrative users who routinely open external spreadsheets.
Verify Microsoft 365 Apps update channels are current on both Windows and macOS clients.

Patch Information

Microsoft has released security updates addressing CVE-2026-81390 for Microsoft 365 Apps, Excel 2016, Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Office Online Server. Consult the Microsoft Security Update Guide for the specific KB articles and build numbers for each product channel.

Workarounds

Enable Protected View for files originating from the internet and Outlook attachments.
Configure Office File Block policy to prevent opening of legacy Excel binary formats from untrusted sources.
Enforce Attack Surface Reduction (ASR) rules that block Office applications from spawning child processes.

bash

# Enable ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled