CVE-2026-81399: Microsoft 365 Apps Information Disclosure

CVE-2026-81399 Overview

CVE-2026-81399 is a buffer over-read vulnerability [CWE-126] in Microsoft Office Excel that permits local information disclosure. An attacker can craft a malicious spreadsheet that, when opened by a user, causes Excel to read memory outside intended bounds. The out-of-bounds read can expose sensitive process memory contents to the attacker. Exploitation requires user interaction, specifically the target opening the crafted file. The flaw affects Microsoft 365 Apps, Excel 2016, and Office 2016 through Office 2024 on both Windows and macOS platforms.

Critical Impact
Successful exploitation discloses confidential process memory from Excel, which may include sensitive workbook data, credentials, or address information useful for chaining with other vulnerabilities.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft Excel 2016, Microsoft Office 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC
Microsoft 365 and Office LTSC editions for macOS

Discovery Timeline

2026-09-08 - CVE-2026-81399 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81399

Vulnerability Analysis

The vulnerability is a buffer over-read within Microsoft Excel's file parsing logic. When Excel processes a specially crafted spreadsheet, it reads past the end of an allocated buffer. The extra bytes returned belong to adjacent memory regions of the Excel process. An attacker who can convince a user to open the file receives disclosed memory contents, potentially including workbook fragments, pointers, or other in-process secrets. The issue does not modify data or crash the application, keeping the exploitation quiet.

Root Cause

The root cause maps to CWE-126: Buffer Over-read. Excel's parser fails to validate a length or offset field within a structured record before copying data. Because the requested read length exceeds the actual buffer size, the routine returns bytes from beyond the allocation. Missing bounds checks during structured document parsing remain a recurring class of defect in Office file format handlers.

Attack Vector

Exploitation is local and requires user interaction. The attacker delivers a weaponized .xls, .xlsx, or related Excel file by email attachment, download, or shared storage. When the user opens the file, Excel parses the malformed structure and returns the leaked memory to attacker-controlled fields, formulas, or external references that exfiltrate the data. No elevated privileges are required on the target host, and the attack succeeds under the standard user context running Excel.

No public proof-of-concept exploit code has been observed for CVE-2026-81399. Refer to the Microsoft CVE-2026-81399 Update Guide for technical details.

Detection Methods for CVE-2026-81399

Indicators of Compromise

Unexpected Excel file attachments from external senders containing complex embedded objects or unusual record structures.
Excel processes (EXCEL.EXE) initiating outbound network connections shortly after opening a document, which can indicate exfiltration of leaked memory.
Office telemetry showing repeated document open failures or protected view bypass attempts on the same file.

Detection Strategies

Inspect inbound email and file-share traffic for Excel documents with malformed BIFF or OOXML records using content-inspection engines.
Correlate Office child-process and network activity to flag Excel sessions that read a document then contact untrusted domains.
Enable Microsoft Defender for Office 365 Safe Attachments and Attack Surface Reduction rules that block Office apps from creating child processes or making outbound calls.

Monitoring Recommendations

Log Office application events, including document open, protected view, and macro trust decisions, to a centralized SIEM.
Alert on Excel processes accessing sensitive credential stores, browser data directories, or unusual file paths after opening a document.
Baseline normal Excel network behavior per user and alert on deviations, particularly outbound HTTP or DNS lookups tied to formula-driven data exfiltration.

How to Mitigate CVE-2026-81399

Immediate Actions Required

Apply the September 2026 Microsoft security updates for all affected Office and Microsoft 365 Apps builds referenced in the Microsoft Update Guide.
Confirm the Office click-to-run channel or MSI build is at or above the fixed version on every workstation, including macOS endpoints.
Instruct users to avoid opening unsolicited Excel attachments and to keep Protected View enabled.

Patch Information

Microsoft has issued vendor guidance for CVE-2026-81399 through the Microsoft Security Response Center. Administrators should consult the Microsoft CVE-2026-81399 Update Guide for the specific build numbers and KB articles per product channel, then deploy through Microsoft Update, WSUS, Intune, or the Office Deployment Tool.

Workarounds

Enforce Protected View for files originating from the internet, email attachments, and unsafe locations through Group Policy.
Block external data connections and Dynamic Data Exchange (DDE) in Excel to reduce exfiltration paths for leaked memory content.
Restrict Excel network egress at the host firewall for users who do not require external data source access.

bash

# Example: enforce Protected View via Group Policy registry keys on Windows
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f