CVE-2026-88190: Microsoft 365 Apps Information Disclosure

CVE-2026-88190 Overview

CVE-2026-88190 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Excel. An unauthorized attacker can disclose information over a network by convincing a user to open a crafted Excel file. The flaw affects Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC across x86 and x64 builds. Exploitation requires user interaction but no prior authentication. Successful exploitation exposes high-confidentiality data from the Excel process memory, though it does not directly impact integrity or availability. Microsoft published the advisory on October 13, 2026 through its Security Update Guide.

Critical Impact
An attacker can read memory outside the intended buffer boundary in Excel and exfiltrate sensitive information, including data from other documents, cached credentials, or heap artifacts rendered in process memory.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office LTSC 2021 (x86 and x64)
Microsoft Office LTSC 2024 (x86 and x64)

Discovery Timeline

2026-10-13 - CVE-2026-88190 published to NVD
2026-10-13 - Microsoft releases security update guidance
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-88190

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Excel file parsing logic. When Excel processes a maliciously crafted spreadsheet, the parser reads memory beyond the bounds of an allocated buffer. The returned data is incorporated into the application state, where it can be observed by an attacker through rendered content, formula outputs, or follow-on network interactions.

The vulnerability requires the victim to open a crafted file delivered through email, a web download, or a shared document location. Attack complexity is low and no privileges are required, but user interaction is mandatory. The confidentiality impact is high, while integrity and availability are unaffected. The EPSS probability of exploitation is 0.853%.

Root Cause

The root cause is missing or insufficient boundary validation when Excel parses a structured record within a workbook. The parser trusts a length or offset field from the input file without validating it against the actual allocated buffer size. Reads performed with the untrusted value traverse adjacent memory, returning data that was never intended to be exposed to the file content.

Attack Vector

The attack vector is network-based through social engineering. The attacker crafts a malicious .xlsx, .xls, or related Office file and delivers it via phishing email, a compromised web page, or a document sharing platform. When the user opens the file in a vulnerable Excel build, the parser triggers the out-of-bounds read. The disclosed memory can contain fragments of other open documents, environment data, or process-resident secrets. Refer to the Microsoft Vulnerability Update CVE-2026-88190 advisory for vendor-specific technical detail.

Detection Methods for CVE-2026-88190

Indicators of Compromise

Inbound email attachments containing Excel files from untrusted or newly registered senders, especially files with unusual record structures or oversized BIFF/OOXML stream fields.
Excel process (EXCEL.EXE) spawning unexpected child processes or initiating outbound network connections immediately after opening an attachment.
Office telemetry showing document load crashes, exception events, or Protected View bypass attempts correlated with external document sources.

Detection Strategies

Inspect Office documents at the mail gateway for malformed structured records, abnormal SharedStrings or BoundSheet sizes, and macros paired with suspicious XML parts.
Hunt endpoint telemetry for EXCEL.EXE reading files from Downloads, Outlook temp directories, or network shares followed by anomalous DNS or HTTP egress.
Correlate Microsoft Defender ASR, AMSI, and Office telemetry events for document-opening anomalies across endpoints running vulnerable Office builds.

Monitoring Recommendations

Monitor process creation events (Sysmon Event ID 1) with parent EXCEL.EXE and alert on scripting hosts, LOLBins, or network utilities.
Track outbound traffic initiated by Office processes and baseline normal destinations to surface exfiltration channels.
Audit Office version inventory with Microsoft Intune or Configuration Manager to identify endpoints still running pre-patch builds of Microsoft 365 Apps, Office 2021, and Office 2024.

How to Mitigate CVE-2026-88190

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Vulnerability Update CVE-2026-88190 advisory to all affected Office installations.
Enforce Protected View and Office File Block policy for files originating from the internet or email attachments.
Instruct users to avoid opening unsolicited Excel attachments and to report suspicious documents to the security team.

Patch Information

Microsoft released a security update for CVE-2026-88190 on October 13, 2026. The update covers Microsoft 365 Apps (Enterprise, x86 and x64), Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Deploy the update through Microsoft Update, Microsoft 365 Apps click-to-run channels, or Microsoft Intune. Validate installation by confirming the updated build number in File > Account > About Excel.

Workarounds

Enable the Office Protected View for files originating from the internet, Outlook attachments, and unsafe locations until patching is complete.
Use Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from injecting into other processes.
Configure Office File Block policy to prevent opening legacy Excel binary formats from untrusted locations.

bash

# Enable Protected View and block legacy Excel formats via Group Policy registry keys
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\FileBlock" /v XL95Workbooks /t REG_DWORD /d 2 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\FileBlock" /v XL97Workbooks /t REG_DWORD /d 2 /f