CVE-2026-88154: Microsoft 365 Apps Information Disclosure

CVE-2026-88154 Overview

CVE-2026-88154 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel. The flaw allows an unauthorized attacker to disclose information over a network when a user opens a crafted Excel document. Successful exploitation requires user interaction but no privileges or prior authentication.

The vulnerability affects multiple supported Office channels, including Microsoft 365 Apps for Enterprise, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024. Microsoft has published guidance through the Microsoft Security Update Guide.

Critical Impact
Attackers can read memory contents outside the intended buffer boundaries in Excel, potentially leaking sensitive data such as heap addresses, document fragments, or in-memory secrets to a remote adversary.

Affected Products

Microsoft 365 Apps for Enterprise (x64 and x86)
Microsoft 365 for macOS
Microsoft Office LTSC 2021 and Office LTSC 2024 (x64 and x86)

Discovery Timeline

2026-10-13 - CVE-2026-88154 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-88154

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in Microsoft Office Excel. Excel reads memory past the end of an allocated buffer when parsing a malformed spreadsheet structure. The read returns adjacent process memory to attacker-controlled logic within the document.

Because the issue is a read primitive, exploitation produces information disclosure rather than code execution. Leaked bytes may include pointer values, document contents, or data from other open workbooks. Attackers can use this leaked data to bypass memory protections such as Address Space Layout Randomization (ASLR) when chaining with a separate memory corruption bug.

The EPSS probability of exploitation is 0.853% at the 57th percentile, indicating moderate forecast exploitation activity.

Root Cause

The root cause is missing or incorrect bounds validation during the parsing of an Office document structure in Excel. A specific field length or offset is trusted without verifying it against the actual buffer size, producing a read beyond the allocated region.

Attack Vector

The attack vector is network-based with required user interaction. An attacker delivers a crafted .xlsx or .xls file through email, a web download, or a shared location. The victim opens the file in Excel, at which point the vulnerable parser reads out-of-bounds memory and returns the data to attacker-controlled document logic for exfiltration.

No code example is published. Refer to the Microsoft Security Update Guide for vendor technical detail.

Detection Methods for CVE-2026-88154

Indicators of Compromise

Inbound email attachments containing Excel files from untrusted or spoofed senders
Excel processes (EXCEL.EXE) spawning unexpected network connections to external hosts shortly after opening a document
Crash events or Watson error reports referencing Excel parsing modules following receipt of a specific document

Detection Strategies

Inspect inbound mail flow for Office documents using sandbox detonation and flag files that trigger out-of-bounds read access violations
Hunt for EXCEL.EXE establishing outbound HTTP, HTTPS, or DNS traffic to low-reputation domains after document open events
Correlate Microsoft Office telemetry with endpoint process trees to identify suspicious parent-child relationships originating from Excel

Monitoring Recommendations

Enable Office cloud protection and Attack Surface Reduction (ASR) rules that log and block suspicious Office behaviors
Forward Office, Defender, and endpoint logs to a centralized data lake and apply detection content for anomalous Excel network activity
Monitor for repeated access violations in Excel across the fleet, which may indicate active probing with crafted documents

How to Mitigate CVE-2026-88154

Immediate Actions Required

Apply the Microsoft October 2026 security updates for all affected Excel channels through Microsoft Update, Microsoft 365 Apps update channels, or the Mac AutoUpdate client
Prioritize patching for users who routinely receive external Excel attachments, including finance, procurement, and executive assistants
Verify the installed Office build after patching against the fixed version listed in the Microsoft Security Update Guide

Patch Information

Microsoft has released security updates for Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024. Consult the Microsoft Security Update Guide for the specific build numbers and KB articles mapped to each channel.

Workarounds

Open untrusted Excel documents in Protected View and disable editing until the sender and content are verified
Block or quarantine Excel attachments from external senders at the mail gateway when patching cannot be completed immediately
Enforce Office macro and external content restrictions through Group Policy to reduce the attack surface available to crafted documents

bash

# Example Group Policy registry keys to enforce Protected View for Excel
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f