CVE-2026-55138 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office products, particularly those using Microsoft Excel, should assess exposure and apply patches to prevent local information disclosure.

Why it matters

CVE-2026-55138 is a Microsoft Excel Information Disclosure Vulnerability that allows an unauthorized attacker to disclose information locally. Defenders should assess exposure, apply patches, and monitor for unauthorized access to sensitive information.

• Verify and apply patches for affected Microsoft Office products to prevent local information disclosure.
• Assess exposure of Microsoft Excel and other affected products in the environment.
• Monitor for unauthorized access to sensitive information.
• Review and update inventory of Microsoft Office products to ensure all affected versions are patched.

Technical summary

The vulnerability is caused by an untrusted pointer dereference in Microsoft Office Excel, allowing an unauthorized attacker to disclose information locally. Affected products include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server.

Defensive priority

Apply patches for affected Microsoft Office products to prevent local information disclosure.

Recommended defensive actions

• Apply patches for Microsoft 365 Apps for Enterprise
• Apply patches for Microsoft Excel 2016
• Apply patches for Microsoft Office 2019
• Apply patches for Microsoft Office 365 for Mac
• Apply patches for Microsoft Office LTSC 2021

Evidence notes

The CVE record and source item provide details on the vulnerability and affected products. Microsoft has released patches for these vulnerabilities. Defenders should verify patch deployment, assess exposure of Microsoft Excel and other affected products in the environment, and monitor for unauthorized access to sensitive information. The vulnerability is caused by an untrusted pointer dereference in Microsoft Office Excel, allowing an unauthorized attacker to disclose information

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.