CVE-2026-44822: Microsoft Office Excel Out-of-Bounds Read Information Disclosure

Technical summary

CVE-2026-44822 is a CWE-125 (out-of-bounds read) vulnerability in Microsoft Office Excel. The flaw allows an unauthenticated remote attacker to read memory beyond the intended boundaries of a data structure, enabling information disclosure. The CVSS 3.1 score of 8.2 (HIGH) reflects network exploitability without authentication or user interaction required, high confidentiality impact, and limited integrity impact. No availability impact is present. The attack vector is network-based with low attack complexity.

Business impact

This vulnerability poses a material information security risk. Attackers can extract proprietary data, credentials, or other sensitive information from systems processing malicious or compromised Excel documents. Organizations relying on Excel for financial modeling, business intelligence, or document handling face potential data exfiltration. The lack of required user interaction increases the risk in environments where files are processed via automated workflows, batch jobs, or email gateways. Reputational harm, regulatory exposure, and competitive disadvantage could result from unauthorized data disclosure.

Affected systems

The vulnerability affects a broad range of Microsoft Office products: Microsoft 365 Apps, Microsoft Excel (standalone), Microsoft 365 subscriptions, Office 2019, Office 2021, Office 2024, and Office Online Server. Both desktop and cloud-based deployment models are impacted. Organizations running any of these product variants should assume exposure unless they have verified patching status.

Exploitability

The vulnerability is readily exploitable. It requires no authentication, no user privileges, and no user interaction—an attacker can trigger the flaw remotely by sending a specially crafted Excel file. The low attack complexity means exploitation does not depend on timing, race conditions, or system-specific configurations. This combination makes the vulnerability attractive to threat actors seeking to harvest information at scale. The fact that it is not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog does not indicate low risk; KEV status lags real-world exploitation.

Remediation

Organizations must apply Microsoft security updates to all affected Office products and versions. Verify patch status across Microsoft 365 Apps, Excel standalone installations, Office 2019, 2021, and 2024 deployments, and Office Online Server instances. Prioritize systems that regularly handle external or untrusted Excel files. Until patching is complete, consider restricting Excel file processing in automated workflows or sandboxing external files.

Patch guidance

Monitor Microsoft's Security Update Guide and official advisories for the specific patch versions addressing CVE-2026-44822. Apply updates to all affected Office product variants listed above. Test patches in a non-production environment first to ensure compatibility with business-critical workflows. For Office Online Server deployments, verify patch availability and deployment procedures specific to your infrastructure. Organizations using Microsoft 365 Apps may receive updates automatically; verify deployment settings and confirm patch installation.

Detection guidance

Monitor for unusual file access patterns or memory reads that could indicate exploitation attempts. Endpoint detection and response (EDR) solutions should be tuned to alert on suspicious Excel process behavior, especially if triggered by network-delivered files or email attachments. Log file processing events and correlate them with system memory dumps or process telemetry. Network-based detection should focus on identifying malicious Excel file transmission and delivery. Consider deploying quarantine rules for Excel files from untrusted sources until patching is complete.

Why prioritize this

This vulnerability merits immediate attention due to its combination of high CVSS score (8.2), broad product scope, network exploitability without authentication, and absence of user interaction requirements. The information disclosure impact is substantial, and the attack surface is large in organizations where Excel files are ingested from external sources or processed programmatically. The extensive affected product list amplifies remediation scope and urgency.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects a HIGH-severity vulnerability. The network attack vector (AV:N) and lack of required authentication (PR:N, UI:N) elevate exploitability. High confidentiality impact (C:H) from arbitrary memory disclosure is balanced by limited integrity impact (I:L) and no availability impact (A:N). Low attack complexity (AC:L) indicates the flaw is straightforward to exploit without special conditions. This profile indicates a vulnerability worthy of rapid patching and elevated monitoring.

Frequently asked questions