CVE-2026-72974 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office installations, particularly those using Excel, should assess exposure and prioritize patching to prevent potential information disclosure.

Why it matters

CVE-2026-72974 is a buffer over-read vulnerability in Microsoft Office Excel that allows unauthorized attackers to disclose information over a network. Defenders should prioritize verifying and patching vulnerable installations to prevent potential information disclosure.

• Verify and patch vulnerable Microsoft Office Excel installations to prevent information disclosure
• Review inventory of Microsoft Office installations to identify potential exposure
• Monitor for potential information disclosure attempts

Technical summary

The CVE-2026-72974 vulnerability is a buffer over-read in Microsoft Office Excel, which allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. Affected products include Microsoft 365 Apps, Office 2016, Office 2019, Office 2021, and Office 2024.

Defensive priority

Defenders should prioritize verifying and patching vulnerable Microsoft Office installations to prevent potential information disclosure.

Recommended defensive actions

• Verify and apply patches for Microsoft Office Excel
• Review and update inventory of Microsoft Office installations
• Monitor for potential information disclosure attempts

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected products. However, specific version information and exploitation details are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.