CVE-2026-81401: Microsoft 365 Apps Information Disclosure

CVE-2026-81401 Overview

CVE-2026-81401 is a type confusion vulnerability in Microsoft Office Excel that allows an unauthorized attacker to disclose information locally. The flaw is classified under [CWE-843] (Access of Resource Using Incompatible Type). Exploitation requires user interaction, typically involving a crafted Excel document opened by a victim. Successful exploitation exposes confidential data from the Excel process memory space to the attacker. The vulnerability affects a broad range of Microsoft Office products across Windows and macOS, including Microsoft 365 Apps, Office 2016, 2019, 2021, 2024, and Office Online Server.

Critical Impact
An attacker can trigger type confusion in Excel to read sensitive process memory, resulting in local disclosure of confidential information such as document contents, cached credentials, or memory addresses useful for further exploitation.

Affected Products

Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
Microsoft Excel 2016, Office 2016, Office 2019, Office 2021 LTSC (Windows and macOS)
Microsoft Office 2024 LTSC (Windows and macOS) and Office Online Server

Discovery Timeline

2026-09-08 - CVE-2026-81401 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81401

Vulnerability Analysis

The vulnerability originates in how Microsoft Excel parses and interprets object types within workbook files. Excel accesses a resource assuming one data type when the underlying object is a different, incompatible type. This mismatch causes the parser to read or interpret memory outside the intended structure. The result is local information disclosure from the Excel process address space.

Type confusion flaws [CWE-843] in complex document parsers typically stem from missing runtime type checks after casts or from trusting embedded type identifiers within the file format. Once triggered, the attacker gains a read primitive that can be used to leak sensitive in-memory data. This class of bug is a common precursor for chaining with memory corruption vulnerabilities to achieve code execution.

Root Cause

Excel deserializes structured records from a workbook and dispatches them to handlers keyed by an internal type tag. When the tag does not match the actual object layout in memory, the handler operates on incompatible fields. Field offsets that would normally reference safe data instead point into adjacent memory, enabling controlled reads.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious .xlsx or .xls workbook and delivers it through phishing, a file share, or a web download. When the victim opens the file in a vulnerable version of Excel, the type confusion is triggered during parsing. The attacker cannot execute the attack remotely without user cooperation. Refer to the Microsoft CVE-2026-81401 Update Guide for vendor-supplied technical details.

Detection Methods for CVE-2026-81401

Indicators of Compromise

Unexpected Excel crashes or EXCEL.EXE faults recorded in Windows Application event logs following the opening of an external workbook.
Excel processes spawning unusual child processes such as cmd.exe, powershell.exe, or rundll32.exe shortly after document open.
Outbound network connections from EXCEL.EXE to untrusted domains immediately after a user opens an attachment.

Detection Strategies

Hunt for Office documents delivered through email that contain anomalous binary records or oversized structured storage streams.
Monitor for Excel process memory access anomalies and abnormal DLL loads through endpoint telemetry.
Correlate mail gateway attachment metadata with endpoint file-open events to identify suspicious workbook delivery patterns.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office child process creation and log the events centrally.
Ingest Office telemetry and Sysmon ProcessCreate and FileCreate events into a SIEM for correlation across users.
Alert on file-integrity changes in user profile directories immediately after Excel opens a workbook from an untrusted source.

How to Mitigate CVE-2026-81401

Immediate Actions Required

Apply the security updates referenced in the Microsoft CVE-2026-81401 Update Guide across all affected Office channels.
Inventory endpoints running Microsoft 365 Apps, Office 2016, 2019, 2021, 2024, and Office Online Server to confirm patch coverage.
Enforce Protected View for files originating from the internet and from Outlook attachments.

Patch Information

Microsoft has released security updates addressing CVE-2026-81401 for all supported Office channels, including Click-to-Run Microsoft 365 Apps, MSI-based Office 2016/2019, LTSC Office 2021/2024, macOS builds, and Office Online Server. Administrators should validate that both x86 and x64 builds are updated and that macOS clients receive updates through Microsoft AutoUpdate.

Workarounds

Block or quarantine inbound Excel attachments from external senders at the mail gateway until patches are deployed.
Configure Office File Block policy to prevent opening legacy Excel binary formats from untrusted locations.
Require users to open untrusted spreadsheets in Excel for the web, which is not affected by client-side parsing paths on the endpoint.

bash

# Enforce Protected View and disable macros from the internet via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f