AI analysis
CVE-2026-85875 is an out-of-bounds read (CWE-125) in Microsoft Excel, the spreadsheet component of Microsoft Office, rated 5.5 (Medium) on the CVSS 3.1 scale. Exploitation is local and requires user interaction: an unauthenticated attacker must persuade a user to open a specially crafted workbook, causing Excel to read past the end of an allocated memory buffer. A successful attack discloses sensitive information from process memory (high confidentiality impact), with no impact on integrity or availability. Affected products include Excel within Microsoft 365 Apps and Microsoft 365, as well as the perpetual Office 2016, 2019, 2021, and 2024 releases. Exploitation status is none known: the flaw is not in CISA KEV, no public proof-of-concept has been published, EPSS is low at 0.4%, and it was addressed in Microsoft's September 2026 Patch Tuesday release (973-974 fixes, including 2 exploited zero-days not attributed to this CVE).
What to do: Apply the September 2026 Microsoft security updates for Excel/Office across all affected editions (Microsoft 365 Apps and Office 2016, 2019, 2021, 2024), using your normal Office update channel or WSUS/Intune reporting to confirm deployment. Because the flaw requires a local user to open a crafted workbook, reinforce user caution around spreadsheets from untrusted sources until patching completes. No public exploit exists and EPSS is low, so there is no urgent emergency-patching driver, but close this out in your regular Patch Tuesday cycle.
Affected
| microsoft Excel (Microsoft Office Excel) | — |
| Microsoft 365 Apps | — |
| Microsoft 365 | — |
| microsoft Office 2016 | — |
| microsoft Office 2019 | — |
| microsoft Office 2021 | — |
| microsoft Office 2024 | — |
Estimated exposure
masshundreds of millions to 1 billion+ Office/Excel users worldwide — Excel ships with every copy of Microsoft Office and Microsoft 365, whose combined installed base is commonly cited at over a billion users with hundreds of millions of commercial seats, though actual exploitation risk is limited to local,…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.