Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is file content. The scope of file content which could be accessed is dependent on the privileges of compromised user.
According to the CVSS metrics, the attack vector is local (AV:L), privileges required are low (PR:L), and user interaction is required (UI:R). What does this mean for this vulnerability?
An attacker would need to run a malicious application locally with standard user privileges and convince a user to connect Excel's Data Streamer add-in to that application.
Security updates
16.0.14334.21048 — https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
https — https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
16.115.26110837 — https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac
Vulnerabilities 1
-
Medium 5.9
Microsoft Office Excel Information Disclosure Vulnerability
Improper control of generation of code ('code injection') in Microsoft Office Excel allows an authorized attacker to disclose information locally.
Revision history
-
#1
Information published.
References
-
CVE-2026-123395 Microsoft Office Excel Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-123395
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss