CVE-2026-68797

This CVE presents as a straightforward OOB read vulnerability in Excel (CVSS 5.5, vector string AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), but the 'local attacker' framing obscures a more dangerous reality. Microsoft 365's collaboration surface—Teams file sharing, SharePoint previews, Outlook attachments, co-authoring sessions—has collapsed the traditional delivery barrier. A malicious workbook reaches victims through a single click, no physical access required. The CVSS model's assumption of isolated local data is incompatible with a M365 environment where Excel's process space contains authentication tokens, Power Query connection strings, recently accessed file paths, and cached SharePoint credentials simultaneously. The specific risk is not the information disclosure itself but what sits adjacent to it in memory. An OOB read in Excel is rarely an isolated event—Excel's document parsing code contains four decades of accumulated format support (XLS, XLSX, XLSM, XLSB, legacy macro formats), much of it in code paths no active engineer maintains. An OOB read in a legacy format parser is often a precursor to more serious exploitation once combined with memory corruption primitives, a pattern seen repeatedly in Excel's historical vulnerability catalog. For prioritization: treat this as a medium-high risk if your organization runs Microsoft 365 with Teams/OneDrive sync enabled, regardless of the CVSS score. The delivery mechanism is already satisfied through normal collaboration workflows. Audit your Excel process environment—users running co-authoring sessions, Power Automate integrations, or external data connections have a significantly larger blast radius than those in isolated VMs. Patch promptly, but recognize that an isolated patch may not address adjacent weaknesses in the same legacy parsing code paths. Monitor whether Microsoft subsequently releases broader document-processing security updates, which would signal they audited the surrounding codebase for similar issues.

Reviewed through automated stages and approved by a human before publication.