CVE-2026-88195: Microsoft 365 Apps Information Disclosure

CVE-2026-88195 Overview

CVE-2026-88195 is an information disclosure vulnerability in Microsoft Office Excel caused by a buffer over-read [CWE-126]. An unauthorized attacker can disclose information over a network by convincing a user to open a crafted Excel document. The flaw affects Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024 across both x64 and x86 editions.

Exploitation requires user interaction and does not require authentication. Successful exploitation leaks memory contents from the Excel process, which may include pointers, handles, or document data useful for chaining with other vulnerabilities.

Critical Impact
Attackers can read beyond allocated buffer boundaries in Excel to expose process memory contents when a user opens a malicious spreadsheet delivered over the network.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office LTSC 2021 (x64 and x86)
Microsoft Office LTSC 2024 (x64 and x86)

Discovery Timeline

2026-10-13 - CVE-2026-88195 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-88195

Vulnerability Analysis

The vulnerability is a buffer over-read [CWE-126] in the Excel parsing logic. Excel reads data past the end of an allocated buffer when processing fields within a crafted spreadsheet. The out-of-bounds read returns adjacent process memory to attacker-influenced code paths, which may embed that memory in rendered content, metadata, or network responses.

The attack vector is network-based, but exploitation requires the victim to open a crafted file. Impact is limited to confidentiality; integrity and availability are not affected. The leaked bytes can expose address space layout details, cached credentials in memory, or fragments of other open documents.

Root Cause

The root cause is missing or incorrect bounds validation during the parsing of a length- or offset-controlled structure in an Excel document. The parser trusts attacker-controlled sizing data and reads beyond the end of the destination buffer. CWE-126 (Buffer Over-read) classifies this specific pattern, where the read operation exceeds the buffer boundary without triggering a write-side corruption.

Attack Vector

An attacker crafts a malicious Excel workbook that triggers the vulnerable parsing path. Delivery mechanisms include email attachments, SharePoint and OneDrive shares, web downloads, and collaboration platforms. When the target opens the file in a vulnerable Excel build, the parser returns out-of-bounds memory to attacker-reachable surfaces such as cell data, embedded objects, or external data queries.

See the Microsoft Security Update for CVE-2026-88195 for vendor technical details.

Detection Methods for CVE-2026-88195

Indicators of Compromise

Excel workbooks (.xlsx, .xlsm, .xlsb, .xls) received from untrusted senders that trigger crashes or Protected View warnings.
Outbound network connections initiated by EXCEL.EXE immediately after opening a document, particularly to unexpected hosts.
Office telemetry events showing Excel reading external data or executing queries referencing attacker-controlled endpoints.

Detection Strategies

Inspect email gateways and web proxies for Excel attachments from untrusted sources and detonate suspicious samples in a sandbox.
Correlate Excel process events with network egress to identify data exfiltration patterns following document open operations.
Hunt for anomalous child processes or memory access patterns originating from EXCEL.EXE.

Monitoring Recommendations

Enable Microsoft Defender for Office 365 Safe Attachments and Safe Links for all users.
Forward Office alerts and Sysmon process telemetry to a centralized analytics platform for retention and hunting.
Monitor for Excel crash events (Application Error entries referencing EXCEL.EXE) which may indicate exploitation attempts.

How to Mitigate CVE-2026-88195

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-88195 to all affected Office installations.
Verify Microsoft 365 Apps update channels are current and that Office LTSC 2021 and 2024 clients have received the October 2026 security rollup.
Enforce Protected View and Block Macros from Internet policies for documents originating outside the organization.

Patch Information

Microsoft published the security update in the MSRC advisory for CVE-2026-88195 on October 13, 2026. Administrators should deploy the update through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or Configuration Manager. Confirm the Office build number after deployment matches the fixed version listed in the vendor advisory.

Workarounds

Open untrusted Excel files in Protected View and avoid clicking Enable Editing unless the source is verified.
Route Excel attachments through a sandbox or detonation service before delivery to end users.
Restrict Excel from loading external data connections and legacy file formats via Group Policy where business processes allow.

bash

# Example Group Policy registry settings to enforce Protected View for Excel
# Apply to HKCU on affected endpoints
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f