CVE-2026-81400: Microsoft 365 Apps Information Disclosure

CVE-2026-81400 Overview

CVE-2026-81400 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel that enables local information disclosure. An unauthorized attacker can read memory outside intended buffer boundaries by convincing a user to open a crafted Excel document. Exploitation requires user interaction but no prior authentication. The flaw affects multiple Excel and Microsoft 365 releases across Windows and macOS.

Microsoft published the advisory through the Microsoft Security Response Center (MSRC). The vulnerability discloses confidential memory contents without impacting integrity or availability. Attackers can leverage leaked data such as memory addresses to bypass mitigations or stage follow-on exploitation.

Critical Impact
A crafted Excel file can leak sensitive process memory contents to an attacker, potentially exposing credentials, tokens, or address layout information useful for exploit chaining.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft Excel 2016 (x64 and x86)
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-81400 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81400

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in Microsoft Office Excel's file parsing logic. Excel reads memory past the end of an allocated buffer when processing a malformed workbook structure. The leaked bytes are returned to the attacker through document content, error output, or side channels observable after the file opens.

Exploitation requires the victim to open the malicious Excel file on the local system. No network access or privileges are required for the attacker to weaponize the payload. The confidentiality impact is high while integrity and availability are not affected. Leaked memory can include heap metadata, pointers, or previously processed document data from the Excel process.

Information disclosure bugs of this class are frequently paired with memory corruption vulnerabilities to defeat Address Space Layout Randomization (ASLR). The Microsoft Security Response Center categorizes the issue under the Office product family.

Root Cause

The root cause is missing or incorrect bounds validation when Excel parses a structured element inside a workbook file. A crafted length or offset field causes the parser to read beyond the intended buffer boundary. Microsoft has not published the specific record type or code path affected.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted .xlsx, .xls, or related Excel file through email, a web download, or a shared drive. When the victim opens the file in a vulnerable Excel client, the parser triggers the out-of-bounds read. The attacker then retrieves the disclosed data from the rendered content or an attacker-controlled channel embedded in the document.

Refer to the Microsoft Security Vulnerability CVE-2026-81400 advisory for vendor guidance.

Detection Methods for CVE-2026-81400

Indicators of Compromise

Unexpected Excel documents delivered from external senders containing complex or malformed structures, macros, or embedded objects.
Excel process crashes, exception events, or Windows Error Reporting entries following the opening of a specific document.
Outbound network connections from EXCEL.EXE shortly after a document opens, indicating potential exfiltration of leaked memory.

Detection Strategies

Monitor endpoint telemetry for anomalous child processes, file writes, or network egress originating from EXCEL.EXE.
Inspect inbound email attachments for Excel files with malformed record structures using content-disarm-and-reconstruction (CDR) or sandbox detonation.
Alert on Office application crashes correlated with newly delivered attachments across multiple users.

Monitoring Recommendations

Collect Office telemetry, Windows Application event logs, and process command-line events into a centralized SIEM for correlation.
Track document provenance metadata using Mark-of-the-Web to prioritize investigation of internet-sourced files.
Review DNS and proxy logs for uncommon domains contacted by Office processes immediately after document open events.

How to Mitigate CVE-2026-81400

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-81400 across all Excel and Microsoft 365 Apps installations.
Prioritize patching internet-facing users, executives, and finance staff who routinely open external spreadsheets.
Confirm Microsoft 365 Apps update channels are current and enterprise-managed Office 2016/2019/2021/2024 LTSC deployments have received the patch.

Patch Information

Microsoft has published fixes through the standard Office and Microsoft 365 Apps update channels. Consult the Microsoft Security Vulnerability CVE-2026-81400 advisory for the exact build numbers and knowledge base articles for each affected SKU. Deploy through Windows Update, Microsoft Update, Configuration Manager, Intune, or the Office Click-to-Run update service.

Workarounds

Enable Protected View for files originating from the internet and other untrusted locations to sandbox document parsing.
Configure Office File Block policies to restrict opening of legacy Excel binary formats where operationally feasible.
Use Attack Surface Reduction (ASR) rules to block Office applications from spawning child processes and making unusual outbound connections.

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f