Out-of-bounds read in Microsoft products - CVE-2026-118728

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing attacker-controlled input. A remote attacker can induce a user to trigger processing of specially crafted input to read memory beyond the intended buffer boundaries and disclose sensitive information.

The Preview Pane is not an attack vector for this vulnerability.

Affected software

How to mitigate CVE-2026-118728

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118728
• https://support.microsoft.com/help/5002946

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office