CVE-2026-48580 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office products, particularly those using Microsoft Excel, should assess exposure and apply patches to prevent local information disclosure.

Why it matters

CVE-2026-48580 is a Microsoft Excel Information Disclosure Vulnerability that allows an unauthorized attacker to disclose information locally. Defenders responsible for Microsoft Office products, particularly those using Microsoft Excel, should assess exposure and apply patches to prevent local information disclosure. The vulnerability has a CVSS score of 5.5 and is considered medium severity.

• Local information disclosure is possible due to the untrusted pointer dereference vulnerability.
• Defenders should prioritize patching affected Microsoft Office products to prevent potential information disclosure.
• Verification of affected versions and exposure is necessary to ensure proper remediation.
• Remediation involves applying patches provided by Microsoft for the affected products.

Technical summary

The vulnerability is caused by an untrusted pointer dereference in Microsoft Office Excel, allowing an unauthorized attacker to disclose information locally. The affected products include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Office Online Server.

Defensive priority

Apply patches for affected Microsoft Office products to prevent local information disclosure.

Recommended defensive actions

• Apply patches for Microsoft 365 Apps for Enterprise
• Apply patches for Microsoft Excel 2016
• Apply patches for Microsoft Office 2019
• Update Microsoft Office 365 for Mac
• Apply patches for Microsoft Office LTSC 2021 and LTSC 2024

Evidence notes

The CVE record and source item provide details on the vulnerability and affected products. Microsoft has released patches for these vulnerabilities. The affected products include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Office Online Server. Defenders should verify the patches and apply them to prevent local information disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.