CVE-2026-81393: Microsoft 365 Apps Information Disclosure

CVE-2026-81393 Overview

CVE-2026-81393 is an out-of-bounds read vulnerability in Microsoft Office Excel that enables local information disclosure. An unauthorized attacker can read memory outside of allocated buffers when a user opens a specially crafted Excel document. The flaw is classified under [CWE-125] (Out-of-bounds Read) and affects multiple supported Office releases including Microsoft 365 Apps, Office 2016, 2019, 2021, and 2024 across Windows and macOS platforms. Exploitation requires user interaction but no privileges or network access.

Critical Impact
Successful exploitation allows an attacker to disclose sensitive process memory contents from Excel, which may include data from other open documents or in-memory secrets.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016, Office 2016, Office 2019 (x64 and x86)
Microsoft Office 2021 and Office 2024 LTSC (Windows and macOS), and Microsoft 365 for macOS

Discovery Timeline

2026-09-08 - CVE-2026-81393 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81393

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Excel's file parsing logic. When Excel processes a malformed spreadsheet, the parser reads memory beyond the bounds of an allocated buffer. The read data can then be reflected back into the document context or leaked through observable Excel behavior. The confidentiality impact is high, while integrity and availability are unaffected. Attack complexity is low, but user interaction is required to open the crafted file.

Root Cause

The root cause is missing or incorrect bounds validation in Excel's parsing routines for structured spreadsheet content, consistent with [CWE-125]. When record lengths, offsets, or index values in a crafted document are not validated against the size of the backing buffer, subsequent read operations access adjacent process memory. Microsoft has not published detailed root-cause information beyond the advisory in the Microsoft Security Update Guide.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted Excel file through email, a shared drive, a web download, or a collaboration platform. When the victim opens the file in a vulnerable version of Excel, the parser triggers the out-of-bounds read. The disclosed memory may contain fragments of other in-memory content within the Excel process. No authentication or elevated privileges are required on the target system.

No verified public proof-of-concept code is available for CVE-2026-81393 at the time of publication. Consult the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-81393

Indicators of Compromise

Excel process (EXCEL.EXE) crashes or Watson error reports generated shortly after opening an untrusted .xls, .xlsx, or .xlsb file.
Unexpected Excel child processes or outbound network connections following the open of an emailed or downloaded spreadsheet.
Delivery of Excel attachments from external senders that bypass macro warnings or Protected View prompts.

Detection Strategies

Inspect inbound email and web traffic for Excel documents originating from untrusted sources, and detonate suspicious samples in a sandbox before delivery.
Correlate Office telemetry with endpoint process events to identify anomalous Excel behavior such as unexpected memory faults or crashes.
Apply YARA and content-inspection rules targeting malformed Office Open XML structures and legacy BIFF records with inconsistent length fields.

Monitoring Recommendations

Monitor Windows Event Log Application channel for Excel faulting module and access violation events (Event ID 1000).
Track Office ClickToRun and Microsoft Update deployment status to identify endpoints running unpatched Excel builds.
Alert on Excel spawning script interpreters (powershell.exe, wscript.exe, cmd.exe) or writing to autorun locations after opening external documents.

How to Mitigate CVE-2026-81393

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Excel and Office installations.
Prioritize patching for endpoints handling untrusted spreadsheets, including finance, HR, and executive systems.
Enforce Protected View and Office Application Guard for files originating from the internet or email attachments.

Patch Information

Microsoft has issued security updates for Microsoft 365 Apps, Microsoft Excel 2016, Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC on both Windows (x64 and x86) and macOS. Deploy the fixed builds via Microsoft Update, ClickToRun, Windows Server Update Services (WSUS), or Microsoft Intune. Refer to the Microsoft Security Update Guide for exact build numbers per channel.

Workarounds

Block or quarantine Excel attachments from external senders at the email gateway until patches are deployed.
Configure Office File Block policy via Group Policy to restrict opening legacy Excel binary formats from untrusted locations.
Educate users to open untrusted spreadsheets only in Excel for the web or Protected View, and to avoid clicking Enable Editing on files from unknown sources.

bash

# Enforce Protected View and File Block via Group Policy registry keys (Windows)
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\FileBlock" /v XL97Workbooks /t REG_DWORD /d 2 /f