CVE-2026-81392: Microsoft 365 Apps Information Disclosure

CVE-2026-81392 Overview

CVE-2026-81392 is an out-of-bounds read vulnerability in Microsoft Office Excel that allows a local attacker to disclose information from process memory. The flaw is classified under [CWE-20] Improper Input Validation. Exploitation requires user interaction, typically the opening of a crafted Excel document.

Microsoft published the advisory on September 8, 2026. The vulnerability affects supported desktop editions of Excel and Microsoft 365 Apps on Windows and macOS. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation can leak sensitive data from Excel process memory, potentially exposing document contents, credentials, or heap pointers usable in follow-on exploits.

Affected Products

Microsoft 365 Apps (x86 and x64, Enterprise)
Microsoft Excel 2016, Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC
Microsoft 365 and Office LTSC editions on macOS

Discovery Timeline

2026-09-08 - CVE-2026-81392 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81392

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Excel triggered when the application parses a specially crafted spreadsheet file. Excel reads memory beyond the intended bounds of an internal buffer, returning attacker-influenced data to code paths that expose it to the user context.

Because the issue only reads memory, it does not directly allow code execution or data modification. The disclosed bytes can, however, include fragments of other documents, session tokens, or address information that undermines exploit mitigations such as Address Space Layout Randomization (ASLR).

Exploitation is local and requires the victim to open a malicious workbook. No elevated privileges are needed to deliver the file, and the attack completes within the user's own Excel process.

Root Cause

The root cause is improper input validation ([CWE-20]) during parsing of an Excel file structure. Excel fails to validate a length, index, or offset before reading from an internal buffer, allowing the read pointer to move past the allocated region. Microsoft has not published the specific parser or record type affected.

Attack Vector

The attack vector is local with required user interaction. An attacker crafts a malicious .xls, .xlsx, or related workbook and delivers it through email, a file share, or a web download. When the user opens the file in a vulnerable Excel build, the parser triggers the out-of-bounds read and the leaked bytes are surfaced through cell contents, error messages, or exfiltration back to attacker-controlled logic embedded in the document.

See the Microsoft Security Update Guide CVE-2026-81392 advisory for vendor guidance.

Detection Methods for CVE-2026-81392

Indicators of Compromise

Unexpected Excel workbook files arriving via email or download that contain malformed BIFF, OOXML, or embedded object records
Excel process crashes, Watson error reports, or WerFault.exe events correlated with opening specific documents
Outbound network requests from excel.exe immediately after a document is opened, particularly to unfamiliar hosts

Detection Strategies

Inspect inbound Office documents at the mail gateway and web proxy using structural analysis rather than signature matching alone
Correlate excel.exe child process activity, ntdll exceptions, and unusual memory access patterns via endpoint telemetry
Hunt for excel.exe initiating DNS queries or HTTP requests shortly after document open events, which can indicate leaked data being exfiltrated

Monitoring Recommendations

Enable Microsoft Office telemetry and forward Application, Security, and Sysmon logs to a central analytics platform
Monitor for Office documents opened from Downloads, Temp, or Outlook attachment directories, especially by high-value users
Track Excel build numbers across the estate to confirm patched versions are deployed everywhere

How to Mitigate CVE-2026-81392

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-81392 to all affected Excel and Office installations
Prioritize patching of endpoints belonging to users who routinely open externally sourced spreadsheets
Verify that both Windows and macOS Microsoft 365 and Office LTSC clients receive the update

Patch Information

Microsoft has issued fixes through the standard Office update channels for Microsoft 365 Apps, Office 2016, 2019, 2021 LTSC, and 2024 LTSC on Windows and macOS. Administrators should confirm distribution through Microsoft Update, the Office Deployment Tool, Intune, or Configuration Manager, then validate installed build numbers against Microsoft's advisory.

Workarounds

Enable Protected View and Office Application Guard for documents originating from the internet or untrusted locations
Block or quarantine Excel file types at the email gateway when senders are external and files are unsigned
Restrict opening of legacy binary Excel formats where business processes allow, favoring OOXML with macros disabled

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f