CVE-2026-70214
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Risk Assessment
An unauthenticated attacker could locally trigger a memory data leak from the Excel process, potentially exposing sensitive information.
Recommendation
Update Microsoft Office Excel to the latest patched version.
Other vulnerabilities in Microsoft Office Excel
See all- CVE-2026-40360High
An out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
- CVE-2026-40359High
A use after free vulnerability in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-20957High
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-20956High
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-20955High
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-20950High
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-20949High
Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.
- CVE-2026-20946High
An out-of-bounds read vulnerability in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-97780High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-97779Medium
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. The attacker can read data outside the intended memory bounds.
Original NVD description (English source)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS