AI analysis
CVE-2026-105718 is an out-of-bounds read (CWE-125) associated with improper input validation (CWE-20) in Microsoft Office Excel. An unauthorized attacker on the network can trigger it if a user opens malicious Excel content; no prior privileges are required, but user interaction is. Successful exploitation can run attacker code with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server are listed as affected. It is not in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Apply Microsoft's October 2026 security updates for Microsoft 365 Apps, Microsoft 365, Office 2021, Office 2024, and Office Online Server as soon as they are offered for your update channel. Until then, do not open unexpected Excel workbooks or links, and keep Protected View and existing application-control policies enabled. No public exploit or CISA KEV listing is known, but the network vector and low complexity make prompt patching the priority.
Affected
| Microsoft 365 Apps | — |
| Microsoft 365 | — |
| Microsoft Office 2021 | — |
| Microsoft Office 2024 | — |
| Microsoft Office Online Server | — |
Estimated exposure
massHundreds of millions of Microsoft 365 and Office users (order-of-magnitude estimate) — Microsoft has publicly reported on the order of hundreds of millions of Microsoft 365 paid seats, and Office 2021, Office 2024, and Office Online Server are widely deployed; no CVE-specific install count is available, so this is an…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.