CVE-2026-81391: Microsoft 365 Apps Information Disclosure

CVE-2026-81391 Overview

CVE-2026-81391 is an information disclosure vulnerability in Microsoft Office Excel caused by the use of an uninitialized resource [CWE-908]. An attacker who convinces a local user to open a specially crafted spreadsheet can read memory contents that were never initialized before use. The disclosed data may include heap fragments, pointer values, or residual content from previous operations. Exploitation requires local access and user interaction, but no privileges. The flaw affects Microsoft 365 Apps, standalone Excel 2016, and Office 2016 through Office 2024 on both Windows and macOS.

Critical Impact
Successful exploitation exposes uninitialized memory contents that may include sensitive data, aiding follow-on attacks such as address space layout randomization (ASLR) bypass.

Affected Products

Microsoft 365 Apps (x64 and x86 enterprise editions)
Microsoft Excel 2016 and Microsoft 365 for macOS
Microsoft Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-81391 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81391

Vulnerability Analysis

The vulnerability originates from Excel reading a resource before it has been properly initialized. When parsing a crafted workbook, Excel allocates a structure and accesses one or more of its fields before the initialization path executes. The uninitialized region retains stale bytes from prior allocations on the heap or stack.

When Excel later renders, serializes, or references those bytes, they can be surfaced to the attacker through file content, formula results, or object properties. The attacker gains a local read primitive against the Excel process memory. This class of flaw is commonly chained with memory corruption bugs to defeat ASLR and enable reliable code execution.

User interaction is required. The victim must open the attacker-supplied .xls, .xlsx, or .xlsm file. Protected View reduces but does not eliminate exposure, since some parsing occurs prior to enabling editing.

Root Cause

The underlying weakness is classified as CWE-908: Use of Uninitialized Resource. A code path in Excel's file parsing or object handling logic reads memory before a corresponding initializer runs. The compiler and runtime do not zero the allocation, leaving whatever content previously occupied the region.

Attack Vector

The attack vector is local with user interaction required. An attacker crafts a malicious Excel document and delivers it through email, a shared drive, a web download, or removable media. When the victim opens the file, Excel triggers the uninitialized read and the attacker retrieves the leaked bytes, either embedded in returned content or exfiltrated through a secondary channel.

No verified proof-of-concept code is publicly available. Refer to the Microsoft Security Update CVE-2026-81391 advisory for vendor technical detail.

Detection Methods for CVE-2026-81391

Indicators of Compromise

Unexpected Excel spreadsheets received from external senders, particularly with unusual embedded objects, macros, or malformed structured storage streams.
Excel process (EXCEL.EXE) making outbound network connections shortly after opening a document, which may indicate exfiltration of leaked memory.
Crash dumps or Windows Error Reporting events referencing Excel modules during document parsing.

Detection Strategies

Inspect inbound email attachments for Office documents and detonate suspect files in a sandbox before delivery.
Correlate Office child-process creation and network activity through endpoint detection and response (EDR) telemetry to surface anomalous behavior following document open events.
Apply Attack Surface Reduction (ASR) rules that block Office applications from creating child processes or writing executable content.

Monitoring Recommendations

Monitor Microsoft Defender SmartScreen and Mark-of-the-Web (MotW) events for spreadsheets originating outside the organization.
Alert on Excel processes accessing unusual file paths, credential stores, or performing large clipboard reads following document open events.
Track Office telemetry for repeated .xlsx or .xlsm parse failures across multiple endpoints, which may indicate targeted campaigns.

How to Mitigate CVE-2026-81391

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-81391 across all affected Office and Microsoft 365 Apps installations.
Enforce Protected View for files originating from the internet, email attachments, and unsafe locations.
Block Office macro execution from untrusted sources through Group Policy.

Patch Information

Microsoft has released updates through the standard servicing channels for Microsoft 365 Apps, Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC on Windows and macOS. Administrators should validate build numbers against the Microsoft Security Update CVE-2026-81391 guidance after deployment.

Workarounds

Enforce Protected View and disable editing for documents sourced from the internet or received as email attachments.
Use Office File Block policy to prevent opening legacy Excel binary formats from untrusted locations until patching completes.
Restrict delivery of Excel attachments at the email gateway from untrusted external senders where operationally feasible.

bash

# Configuration example: enforce Protected View for Excel via registry (Windows)
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f