CVE-2026-88175 Microsoft CVE debrief

Who should care

Defenders of Microsoft Office Excel, especially those using Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, should assess exposure and apply patches or mitigations to prevent potential information disclosure.

Why it matters

CVE-2026-88175 is a medium-severity vulnerability in Microsoft Office Excel that allows information disclosure over a network. Defenders should assess exposure, prioritize remediation, and monitor for potential disclosure attempts.

• Defenders need to assess exposure and prioritize remediation to prevent potential information disclosure.
• Verify inventory of affected products and apply patches or mitigations.
• Monitor for potential information disclosure attempts.
• Remediation priority follows from the medium CVSS score and potential impact on sensitive information.

Technical summary

The vulnerability exists due to an out-of-bounds read issue in Microsoft Office Excel, allowing an unauthorized attacker to disclose information over a network. Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024.

Defensive priority

Medium priority for defenders of Microsoft Office Excel, especially those using Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure of Microsoft Office Excel, especially in Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 deployments.
• Apply patches or mitigations as recommended by Microsoft.
• Monitor for potential information disclosure attempts.
• Verify inventory of affected products and prioritize remediation.

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or impact. Official sources, including the CVE Program and NVD, confirm the vulnerability exists in multiple Microsoft Office products.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.