Executive brief
Microsoft Excel contains an out-of-bounds read vulnerability that allows an attacker to execute arbitrary code on a victim's computer. An attacker could exploit this by crafting a malicious spreadsheet file that, when opened by a user, triggers the vulnerability and grants the attacker the ability to run commands with the same privileges as the user. This could lead to data theft, installation of malware, or compromise of the entire system.
Technical details
The vulnerability is an out-of-bounds read in Microsoft Excel that can be triggered when processing specially crafted spreadsheet files. An attacker can construct a malicious Excel file designed to read memory beyond the intended buffer boundaries, potentially exposing sensitive data or enabling code execution. The attack requires user interaction—a victim must open the malicious file—but no additional authentication is needed. Successful exploitation grants the attacker code execution in the context of the user running Excel. Microsoft has released patches to address this issue.
Affected products
- Microsoft Excel
Timeline
- 2026-09-08: disclosed