Out-of-bounds read in Microsoft Office for macOS and Microsoft Office - CVE-2026-119999

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing input. A remote attacker can supply specially crafted content that requires user interaction to potentially read small portions of heap memory.

The Preview Pane is not an attack vector for this vulnerability.

Affected software

How to mitigate CVE-2026-119999

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-119999
• https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office