CVE-2026-81395: Microsoft 365 Apps Information Disclosure

CVE-2026-81395 Overview

CVE-2026-81395 is an out-of-bounds read vulnerability [CWE-125] affecting Microsoft Office Excel and related Microsoft 365 products. An unauthorized attacker can exploit this flaw to disclose sensitive information locally when a user opens a specially crafted spreadsheet. The vulnerability requires user interaction but no privileges, making phishing-based delivery a practical attack path. Microsoft published the advisory on September 8, 2026, and the flaw affects Excel across Windows and macOS deployments, including perpetual and subscription editions from Office 2016 through Office 2024.

Critical Impact
Successful exploitation exposes memory contents that may include sensitive data such as heap addresses, document fragments, or credentials residing in the Excel process address space.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC (x64, x86, and macOS)
Microsoft 365 for macOS

Discovery Timeline

2026-09-08 - CVE-2026-81395 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81395

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Excel's parsing logic. When Excel processes a malformed spreadsheet, the application reads memory outside the intended buffer boundary. The read data can then be returned to attacker-controlled structures or rendered in ways that expose it to the attacker. The flaw impacts confidentiality only; integrity and availability of the target system are not directly affected. Because the vulnerability triggers during file parsing, delivery through email attachments or downloaded documents is the primary exploitation channel.

Root Cause

The root cause is missing or insufficient bounds validation when Excel accesses memory during file structure parsing. The parser trusts size or offset fields inside the crafted document and reads past the end of an allocated buffer. This class of defect [CWE-125] frequently arises in complex binary and XML-based document formats such as XLS, XLSX, and related Excel formats where nested records reference variable-length data.

Attack Vector

Exploitation requires the victim to open a malicious spreadsheet. The attack vector is local because file processing occurs on the target host, but the file itself can be delivered remotely through phishing, shared drives, or web downloads. No authentication is required on the target. The disclosed memory can be exfiltrated by embedding the leaked content within cells, formulas, or external references that the crafted document evaluates during rendering.

No public proof-of-concept exploit is available for CVE-2026-81395 at the time of publication. Refer to the Microsoft Vulnerability Update CVE-2026-81395 for authoritative technical details.

Detection Methods for CVE-2026-81395

Indicators of Compromise

Unexpected Excel process crashes or Windows Error Reporting entries referencing EXCEL.EXE after opening an untrusted attachment.
Spreadsheet files containing malformed record structures, unusually large offset fields, or non-standard binary segments.
Outbound network requests initiated by Excel to unfamiliar domains immediately after a document open event, indicating potential exfiltration of leaked memory.

Detection Strategies

Inspect email gateways and file-sharing platforms for Excel attachments from untrusted senders, especially files with mismatched extensions or high entropy.
Correlate Office telemetry with process creation events to flag Excel spawning unusual child processes or performing network activity after opening a document.
Apply YARA or content inspection rules that identify Excel documents with anomalous record sizes consistent with parser abuse.

Monitoring Recommendations

Enable and forward Microsoft Office telemetry, including document open events and crash reports, to a centralized log platform.
Monitor endpoints for Excel-initiated network connections to non-corporate destinations.
Track patch compliance for Microsoft 365 Apps and standalone Office installations across the fleet.

How to Mitigate CVE-2026-81395

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Vulnerability Update CVE-2026-81395 advisory to all affected Excel and Office installations.
Prioritize patching for endpoints that regularly receive external documents, such as finance, procurement, and executive workstations.
Alert users to avoid opening unsolicited spreadsheet attachments until patches are deployed.

Patch Information

Microsoft has released fixes through the standard update channels for Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC on both Windows and macOS. Consult the Microsoft Security Response Center advisory for build numbers and deployment guidance specific to each channel.

Workarounds

Enable Protected View for files originating from the internet and other untrusted locations.
Configure Office File Block policies to prevent opening legacy Excel formats from untrusted sources when patching is delayed.
Restrict Excel's ability to load external content and disable automatic evaluation of formulas that reference remote resources.

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f