CVE-2026-81399

CVE-2026-81399 is a buffer over-read (out-of-bounds read, CWE-126) in Microsoft Office Excel that allows an unauthorized attacker to disclose information locally. Exploitation requires user interaction: the victim must open a specially crafted spreadsheet, after which the flaw causes Excel to read past the intended buffer and potentially expose memory contents to the attacker. The impact is limited to confidentiality (CVSS 3.1: 5.5, medium) with no effect on integrity or availability, and the attack works only in the local context rather than over a network. All supported Office suites are in scope, including Microsoft 365 Apps, standalone Excel, and Office 2016, 2019, 2021, and 2024. No public proof of concept is known, the CVE is not on CISA's KEV list, and EPSS estimates only a 0.4% chance of exploitation in the next 30 days.

What to do: Deploy the relevant Microsoft security update for Excel across all supported Office versions (2016, 2019, 2021, 2024, and Microsoft 365 Apps) via Microsoft Update or Click-to-Run, since Microsoft 365 channel builds auto-update once patched. Because triggering requires a victim to open a malicious workbook, remind users not to open unsolicited spreadsheet attachments. Before broad rollout, note the vendor-confirmed known issue in which the KB5002914 update breaks copy and paste in Excel, and validate the workaround on a pilot group.