CVE-2026-85875: Microsoft 365 Apps Information Disclosure

CVE-2026-85875 Overview

CVE-2026-85875 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel that allows a local, unauthenticated attacker to disclose information from process memory. Exploitation requires user interaction, typically by opening a crafted spreadsheet file. The flaw affects multiple supported Office builds, including Microsoft 365 Apps, Excel 2016, and Office 2016 through 2024 on Windows and macOS. Successful exploitation exposes potentially sensitive data resident in Excel's memory space, which can include document contents, credentials, or pointers useful for chaining with other vulnerabilities.

Critical Impact
An attacker who convinces a user to open a malicious Excel document can read out-of-bounds memory, disclosing sensitive process data on the local system.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft Excel 2016, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024
Microsoft 365 and Office LTSC 2021/2024 for macOS

Discovery Timeline

2026-09-08 - CVE-2026-85875 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-85875

Vulnerability Analysis

The vulnerability is an out-of-bounds read within Microsoft Excel's file parsing logic. When Excel processes a specially crafted workbook, the application reads memory beyond the bounds of an allocated buffer. The disclosed bytes can be exfiltrated back through document structures, side channels, or subsequent user actions. The scope is limited to confidentiality; the flaw does not directly grant code execution, modification, or denial-of-service capabilities.

Attackers typically weaponize such issues by embedding a malformed spreadsheet in a phishing email or hosting it on a file-sharing service. Because the attack vector is local and requires user interaction, delivery relies on social engineering rather than a remote network exploit.

Root Cause

The underlying defect is missing or incorrect bounds validation on a length or index field parsed from an Excel document. When the parser trusts attacker-controlled values, it reads adjacent memory regions that fall outside the intended structure. This class of defect is tracked as CWE-125 (Out-of-bounds Read).

Attack Vector

Exploitation requires a user to open a crafted .xls, .xlsx, or related Excel document on a vulnerable installation. No privileges or prior authentication to the host are needed. The disclosed memory contents can then be surfaced in cells, error messages, or serialized objects that the attacker retrieves. Refer to the Microsoft CVE-2026-85875 Update Guide for vendor technical detail.

No public proof-of-concept or in-the-wild exploitation has been reported for this issue at the time of publication.

Detection Methods for CVE-2026-85875

Indicators of Compromise

Unexpected Excel process crashes or Windows Error Reporting entries referencing EXCEL.EXE shortly after opening an attachment.
Excel documents arriving from untrusted senders that contain unusually large or malformed BIFF/OOXML records.
Outbound network connections initiated by EXCEL.EXE immediately following document open, indicating potential data exfiltration.

Detection Strategies

Hunt for Excel spawning unusual child processes or accessing sensitive files outside the user's normal document paths.
Inspect email gateways and file-sharing platforms for spreadsheet attachments with anomalous structures or macros paired with crafted binary records.
Correlate document-open events with subsequent authentication or credential access telemetry to identify chained exploitation attempts.

Monitoring Recommendations

Enable Microsoft Office telemetry and forward Office Alerts and application crash events to a centralized log store.
Track EXCEL.EXE memory access patterns and unhandled exception events across managed endpoints.
Alert on Excel processes reading from or writing to Local Security Authority, credential stores, or browser profile directories.

How to Mitigate CVE-2026-85875

Immediate Actions Required

Apply the security updates listed in the Microsoft CVE-2026-85875 Update Guide across all affected Windows and macOS Office installations.
Prioritize patch deployment for users who routinely handle spreadsheets from external sources.
Re-enable Protected View and Office Trust Center policies for files originating from the internet or email attachments.

Patch Information

Microsoft has published fixes through the Microsoft Update Guide covering Microsoft 365 Apps, Excel 2016, Office 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024 on both Windows and macOS. Administrators should validate the installed Office build number against the fixed versions documented in the vendor advisory.

Workarounds

Enforce Protected View for files originating from the internet, Outlook attachments, and unsafe locations through Group Policy.
Block or quarantine spreadsheet attachments from unauthenticated external senders at the email gateway.
Restrict opening of legacy binary Excel formats (.xls) where business processes permit modern formats only.

bash

# Group Policy registry keys to enforce Protected View for Excel
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f