CVE-2026-88201: Microsoft 365 Apps Information Disclosure

CVE-2026-88201 Overview

CVE-2026-88201 is a buffer over-read vulnerability in Microsoft Office Excel that allows an unauthorized attacker to disclose information over a network. The flaw is tracked under CWE-126: Buffer Over-read and affects multiple supported Excel builds across Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC on both x64 and x86 platforms. Exploitation requires user interaction, typically opening a crafted spreadsheet, but no authentication or elevated privileges. Successful exploitation exposes memory contents to the attacker, enabling leakage of sensitive data from the Excel process address space.

Critical Impact
An attacker who convinces a user to open a malicious Excel file can read out-of-bounds memory and exfiltrate potentially sensitive information from the host process.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2021 LTSC (x64 and x86)
Microsoft Office 2024 LTSC (x64 and x86)

Discovery Timeline

2026-10-13 - CVE-2026-88201 published to the National Vulnerability Database
2026-10-14 - Entry last modified in the NVD database

Technical Details for CVE-2026-88201

Vulnerability Analysis

The vulnerability is a buffer over-read in Microsoft Office Excel's file parsing logic. A buffer over-read occurs when code reads data past the end of a valid memory buffer, returning adjacent process memory to the caller. In Excel, this condition is reached by processing a specifically malformed spreadsheet that causes the parser to compute an incorrect length or index when reading structured content. Because the over-read occurs during document processing, the leaked bytes may contain stack frames, heap metadata, pointers useful for defeating Address Space Layout Randomization (ASLR), or fragments of other open workbook data. The vulnerability does not permit code execution or data modification by itself, but the disclosed memory can be weaponized in follow-on attacks against the same host.

Root Cause

The underlying defect is improper bounds validation when Excel reads a length-prefixed or indexed structure from a crafted file. CWE-126 describes conditions where a read primitive is driven past a buffer's declared size due to incorrect boundary math or trust in attacker-controlled length fields.

Attack Vector

The attack vector is network-based with required user interaction. An attacker delivers a weaponized .xlsx, .xlsb, or similar Excel-parsed file through email, a web download, a shared drive, or a collaboration platform. When the recipient opens the file in a vulnerable Excel build, the parser performs the over-read and returns memory contents to attacker-controlled sinks within the document, which can be exfiltrated through follow-on channels. No credentials and no prior access to the target are required.

No verified proof-of-concept code is available for CVE-2026-88201. Refer to the Microsoft CVE-2026-88201 Advisory for vendor technical details.

Detection Methods for CVE-2026-88201

Indicators of Compromise

Inbound email attachments or downloaded .xlsx, .xlsb, .xls, or .xlsm files from untrusted senders that trigger Excel crashes or Protected View anomalies.
Unexpected child processes spawned by EXCEL.EXE immediately after opening a document, particularly powershell.exe, cmd.exe, or mshta.exe.
Outbound network connections from EXCEL.EXE to uncommon domains shortly after document open events.

Detection Strategies

Hunt for Excel process telemetry showing document open events followed by anomalous memory read patterns or Watson/Werfault crash reports referencing Excel parsing modules.
Correlate email gateway attachment metadata with endpoint document-open events to identify delivery of suspicious workbooks.
Flag Office documents containing embedded external links or OLE objects originating from external senders.

Monitoring Recommendations

Monitor EXCEL.EXE for unusual module loads, unexpected network egress, and child-process creation outside normal baselines.
Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from spawning child processes and from creating executable content.
Centralize Office telemetry, email gateway logs, and endpoint identifications into a SIEM for cross-source correlation of document-borne attacks.

How to Mitigate CVE-2026-88201

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-88201 Advisory to all affected Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC installations.
Verify that Microsoft 365 Apps update channels are current and that LTSC builds have received the corresponding security rollup.
Enforce Protected View and Office File Block policies for documents originating from the internet or email.

Patch Information

Microsoft has issued fixes for CVE-2026-88201 through its standard update channels. Administrators should consult the Microsoft CVE-2026-88201 Advisory for the exact build numbers covering Microsoft 365 Apps (x64/x86 Enterprise), Office 2021 LTSC (x64/x86), and Office 2024 LTSC (x64/x86), and deploy them through Microsoft Update, Click-to-Run, WSUS, or Intune.

Workarounds

Open untrusted spreadsheets in Protected View or in an isolated viewer rather than the full Excel client until patching is complete.
Use email gateway controls to strip or quarantine Office attachments from external senders that fail reputation checks.
Deploy Microsoft Defender ASR rules to block Office processes from creating child processes and from loading unsigned content.

bash

# Enable key Attack Surface Reduction rules via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A, `
  3B576869-A4EC-4529-8536-B80A7769E899 `
  -AttackSurfaceReductionRules_Actions Enabled, Enabled