CVE-2026-44822: Microsoft Excel Information Disclosure Vulnerability

Synopsis

An out-of-bounds read vulnerability in Microsoft Excel allows an unauthenticated attacker to reach the affected application over a network and trigger unintended memory disclosure. No credentials or user interaction are required to exploit the flaw, and successful exploitation exposes sensitive information stored in the process's memory while also enabling limited data modification. Patched-image rebuilds at versions 16.0.5556.1001 and 16.0.10417.20137 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected Excel service over the network; no local or physical access is assumed by the CVSS vector (AV:N).

• AuthenticationNot required

  No credentials of any privilege level are needed; the CVSS vector specifies PR:N, meaning the endpoint is reachable without authentication.

• Victim interactionNot required

  The attacker does not need to trick or wait on any user action; UI:N means exploitation is fully attacker-driven.

• Attack complexityDetail

  Attack complexity is rated Low (AC:L), meaning the exploit is reliable and requires no special race conditions, memory-layout assumptions, or other environmental preconditions.

Blast Radius

• An attacker reads contents of the Excel process memory, which may include in-memory spreadsheet data, formulas, cached credentials, or session tokens.
• The CVSS vector includes a Low integrity impact (I:L), meaning an attacker can also make limited modifications to data accessible by the process.
• Availability is not impacted; the affected service continues running, making the information disclosure harder to detect through uptime monitoring alone.