CVE-2026-81958: Microsoft 365 Apps Information Disclosure

CVE-2026-81958 Overview

CVE-2026-81958 is an information disclosure vulnerability in Microsoft Office Excel caused by the use of an uninitialized resource [CWE-908]. An unauthorized attacker can leverage this flaw to read memory contents that were never explicitly initialized before use. Exploitation requires local access and user interaction, typically by convincing a target to open a crafted Excel workbook. Successful exploitation exposes sensitive process memory to the attacker, which may include data belonging to other documents, credentials, or pointers useful for bypassing memory protections.

The vulnerability affects multiple supported Excel versions across Windows and macOS, including Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024.

Critical Impact
Attackers can disclose sensitive in-process memory from Excel when a user opens a malicious workbook, potentially exposing data from other open documents or aiding chained exploitation.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64) and Microsoft 365 for macOS
Microsoft Excel 2016, Microsoft Office 2016 and Office 2019 (x86 and x64)
Microsoft Office LTSC 2021 and Office LTSC 2024 (Windows and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-81958 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81958

Vulnerability Analysis

The flaw is a use of uninitialized resource weakness [CWE-908] in Microsoft Office Excel. Excel allocates a memory buffer or object during workbook parsing but fails to initialize it before consuming its contents. When the uninitialized region is later serialized, rendered, or exposed through file structures under attacker influence, residual data from prior allocations leaks into attacker-observable output. The result is a confidentiality-only impact: no code execution or data modification occurs from this issue alone.

Exploitation requires the victim to open a specially crafted spreadsheet locally. The attacker cannot trigger the condition remotely without user action, which limits mass exploitation but suits targeted phishing scenarios where leaked memory improves reconnaissance or supports follow-on exploits.

Root Cause

The root cause is a missing initialization step on a heap-allocated structure processed during workbook handling. Because the memory is not zeroed or populated before use, its contents reflect whatever data previously occupied that allocation. Microsoft's advisory (see Microsoft Security Update CVE-2026-81958) does not publicly detail the affected parser routine.

Attack Vector

The attack requires local file processing and user interaction. A typical scenario delivers a crafted .xlsx or legacy Excel workbook through email, a shared drive, or a download link. When the target opens the file, Excel processes the malformed structure, reads uninitialized memory, and surfaces that memory through file content, clipboard data, or subsequent save operations that an attacker can recover.

No verified public exploit code is available for CVE-2026-81958 at the time of writing. See the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-81958

Indicators of Compromise

Excel workbooks with malformed or unusual internal structures arriving via email or external file shares, particularly from unverified senders.
Excel processes (EXCEL.EXE) spawning unexpected child processes or accessing sensitive files immediately after opening a document from an internet zone.
Save-as or clipboard operations emitting binary artifacts inconsistent with legitimate workbook content.

Detection Strategies

Alert on Office applications opening files from Downloads, Temp, or Outlook attachment directories followed by anomalous file writes.
Correlate Mark-of-the-Web (MOTW) attributes on inbound spreadsheets with subsequent Excel telemetry to prioritize investigation of untrusted documents.
Hunt for Excel-generated files containing high-entropy byte ranges that suggest leaked memory rather than typical spreadsheet content.

Monitoring Recommendations

Ingest Microsoft Defender and endpoint telemetry into a centralized data lake to correlate document open events with process, file, and network activity.
Monitor Office application crash reports and exception telemetry, which often accompany memory-safety issues during exploitation attempts.
Track patch state across all Office SKUs, including macOS and LTSC installations, to identify unpatched endpoints exposed to crafted workbooks.

How to Mitigate CVE-2026-81958

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update Guide to all affected Office and Microsoft 365 installations.
Prioritize patching for users who routinely process external spreadsheets, including finance, procurement, and executive staff.
Reinforce user awareness on opening unsolicited Office attachments, and enable Protected View for files sourced from the internet.

Patch Information

Microsoft has published fixed builds through the Microsoft Security Update Guide entry for CVE-2026-81958. Updates cover Microsoft 365 Apps, Microsoft 365 for macOS, Excel 2016, Office 2016, Office 2019, Office LTSC 2021 (Windows and macOS), and Office LTSC 2024 (Windows and macOS). Deploy through Microsoft Update, Click-to-Run channels, WSUS, or Intune according to organizational patch management practice.

Workarounds

Enforce Protected View and Application Guard for Office to isolate untrusted workbooks until patches are deployed.
Block or quarantine Office documents from external senders at the email gateway when they contain macros, external links, or unusual embedded objects.
Restrict file previewers and third-party integrations that automatically render Excel content without user consent.

bash

# Example: enforce Protected View for files from the internet via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f