{"id":"CVE-2026-55898","state":"PUBLISHED","title":"Microsoft Excel Information Disclosure Vulnerability","description":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.","publishedAt":"2026-07-14T17:09:10.387Z","updatedAt":"2026-10-28T20:05:51.865Z","severity":{"score":6.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Microsoft 365 Apps for Enterprise","Microsoft Microsoft Excel 2016","Microsoft Microsoft Office 2019","Microsoft Microsoft Office 365 for Mac","Microsoft Microsoft Office LTSC 2021","Microsoft Microsoft Office LTSC 2024","Microsoft Microsoft Office LTSC for Mac 2021","Microsoft Microsoft Office LTSC for Mac 2024","Microsoft Office Online Server"],"affected":[{"vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Excel 2016","versions":[{"version":"16.0.0.0","status":"affected","lessThan":"16.0.5561.1001","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office 2019","versions":[{"version":"19.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office 365 for Mac","versions":[{"version":"1.0.0","status":"affected","lessThan":"16.111.26071215","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"16.111.26071215","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.111.26071215","versionType":"custom"}]},{"vendor":"Microsoft","product":"Office Online Server","versions":[{"version":"16.0.0.0","status":"affected","lessThan":"16.0.10417.20175","versionType":"custom"}]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55898"],"weaknesses":["CWE-125"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/55xxx/CVE-2026-55898.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-55898","state":"PUBLISHED","datePublished":"2026-07-14T17:09:10.387Z","dateUpdated":"2026-10-28T20:05:51.865Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2026-06-17T17:36:34.621Z"},"containers":{"cna":{"title":"Microsoft Excel Information Disclosure Vulnerability","descriptions":[{"lang":"en-US","value":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally."}],"affected":[{"vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Excel 2016","versions":[{"version":"16.0.0.0","status":"affected","lessThan":"16.0.5561.1001","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office 2019","versions":[{"version":"19.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office 365 for Mac","versions":[{"version":"1.0.0","status":"affected","lessThan":"16.111.26071215","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"16.111.26071215","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.111.26071215","versionType":"custom"}]},{"vendor":"Microsoft","product":"Office Online Server","versions":[{"version":"16.0.0.0","status":"affected","lessThan":"16.0.10417.20175","versionType":"custom"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55898","name":"Microsoft Excel Information Disclosure Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"MEDIUM","baseScore":6.1,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","description":"CWE-125: Out-of-bounds Read","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-10-28T20:05:51.865Z"},"datePublic":"2026-07-14T14:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"16.111.26071215"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:*:*:*:*:ltsc:*:*:*","versionStartIncluding":"16.0.0.0","versionEndExcluding":"16.0.10417.20175"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"19.0.0","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"16.111.26071215"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.111.26071215"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:excel_2016:*:*:*:*:*:*:x86:*","versionStartIncluding":"16.0.0.0","versionEndExcluding":"16.0.5561.1001"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-14T18:30:58.088318Z","id":"CVE-2026-55898","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-14T18:31:08.843Z"}}]}}}