Out-of-bounds read in Microsoft Office for macOS and Microsoft Excel - CVE-2026-68814

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds read in Microsoft Office Excel when parsing a crafted Office file. A remote attacker can send a specially crafted Office file and convince the victim to open it to execute arbitrary code.

User interaction is required to open the crafted file, and the Preview Pane is not an attack vector.

Affected software

How to mitigate CVE-2026-68814

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-68814
• https://www.microsoft.com/en-us/msrc/vulnerability-guide/vulnerability/CVE-2026-68814

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office