Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

The version of Microsoft Office for Mac installed on the remote host is affected by multiple vulnerabilities as referenced in the september-16-2026 advisory.

  - Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a     network. (CVE-2026-69678, CVE-2026-69767, CVE-2026-69797)

  - Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a     network. (CVE-2026-69626)

  - Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network.
    (CVE-2026-69632)

  - Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a     network. (CVE-2026-69671, CVE-2026-72972, CVE-2026-72973, CVE-2026-78510, CVE-2026-78511, CVE-2026-78517,     CVE-2026-78521, CVE-2026-78526, CVE-2026-80085, CVE-2026-81952)

  - Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over     a network. (CVE-2026-69686, CVE-2026-69722, CVE-2026-69759, CVE-2026-78504)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a     network. (CVE-2026-78518)

  - Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code     locally. (CVE-2026-81386, CVE-2026-81389, CVE-2026-81397, CVE-2026-81398, CVE-2026-81947, CVE-2026-81948,     CVE-2026-81951, CVE-2026-81959, CVE-2026-81960)

  - Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code     locally. (CVE-2026-81388, CVE-2026-81396, CVE-2026-81953)

  - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
    (CVE-2026-81954)

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information     locally. (CVE-2026-81390, CVE-2026-81392, CVE-2026-81393, CVE-2026-81395, CVE-2026-81400, CVE-2026-85875)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Office Online Server or Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code     locally. (CVE-2026-81947)

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
    (CVE-2026-81956)

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information     locally. (CVE-2026-81390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Office Products are missing a security update. They are, therefore, affected by multiple vulnerabilities:

  - Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform     spoofing over a network. (CVE-2026-64918)

  - Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over     a network. (CVE-2026-69285, CVE-2026-69442, CVE-2026-78505)

  - Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute     code over a network. (CVE-2026-69529, CVE-2026-69778)

  - Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a     network. (CVE-2026-69626)

  - Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to disclose     information over a network. (CVE-2026-69734)

  - Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over     a network. (CVE-2026-69739, CVE-2026-80089)

  - Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code     over a network. (CVE-2026-69764, CVE-2026-78510, CVE-2026-78526, CVE-2026-81952)

  - Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information     over a network. (CVE-2026-72974)

  - Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code     over a network. (CVE-2026-78512)

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information     over a network. (CVE-2026-78515)

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a     network. (CVE-2026-78518)

  - Out-of-bounds write in Microsoft Office allows an unauthorized attacker to execute code over a     network. (CVE-2026-78524)

  - Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose     information over a network. (CVE-2026-80084)

  - Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to disclose     information over a network. (CVE-2026-80087)

  - Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information     over a network. (CVE-2026-80088)

  - Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose     information over a network. (CVE-2026-80091)

  - Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code     locally. (CVE-2026-81386, CVE-2026-81389, CVE-2026-81397, CVE-2026-81398, CVE-2026-81947,     CVE-2026-81948, CVE-2026-81951, CVE-2026-81959, CVE-2026-81960)

  - Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel     allows an unauthorized attacker to disclose information locally. (CVE-2026-81387, CVE-2026-81394)

  - Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute     code locally. (CVE-2026-81388, CVE-2026-81396, CVE-2026-81953)

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information     locally. (CVE-2026-81390, CVE-2026-81392, CVE-2026-81393, CVE-2026-81395, CVE-2026-81400,     CVE-2026-85875)

  - Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose     information locally. (CVE-2026-81391, CVE-2026-81958)

  - Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information     locally. (CVE-2026-81399)

  - Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an     unauthorized attacker to disclose information locally. (CVE-2026-81401)

  - Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute     code locally. (CVE-2026-81949)

  - Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
    (CVE-2026-81950)

  - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
    (CVE-2026-81954)

  - Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to     execute code over a network. (CVE-2026-81955)

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code     locally. (CVE-2026-81956, CVE-2026-81957)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Excel Products are missing a security update. They are, therefore, affected by multiple vulnerabilities:

  - Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code     over a network. (CVE-2026-78512)

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a     network. (CVE-2026-78518)

  - Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code     locally. (CVE-2026-81386, CVE-2026-81389, CVE-2026-81397, CVE-2026-81398, CVE-2026-81947,     CVE-2026-81948, CVE-2026-81951, CVE-2026-81959, CVE-2026-81960)

  - Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel     allows an unauthorized attacker to disclose information locally. (CVE-2026-81387, CVE-2026-81394)

  - Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute     code locally. (CVE-2026-81388, CVE-2026-81396, CVE-2026-81953)

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information     locally. (CVE-2026-81390, CVE-2026-81392, CVE-2026-81393, CVE-2026-81395, CVE-2026-81400,     CVE-2026-85875)

  - Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose     information locally. (CVE-2026-81391, CVE-2026-81958)

  - Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information     locally. (CVE-2026-81399)

  - Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an     unauthorized attacker to disclose information locally. (CVE-2026-81401)

  - Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute     code locally. (CVE-2026-81949)

  - Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
    (CVE-2026-81950)

  - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
    (CVE-2026-81954)

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code     locally. (CVE-2026-81956, CVE-2026-81957)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
346427	Security Updates for Microsoft Office Products (September 2026) (macOS)	Nessus	MacOS X Local Security Checks	Local	high
344559	Security Updates for Microsoft Excel Products C2R (September 2026)	Nessus	Windows	Local	high
344556	Security Updates for Microsoft Office Online Server (September 2026)	Nessus	Windows : Microsoft Bulletins	Local	high
344286	Security Updates for Microsoft Office Products (September 2026)	Nessus	Windows : Microsoft Bulletins	Local	high
344285	Security Updates for Microsoft Excel Products (September 2026)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2026-81390

medium

Tenable Plugins

high

high

high

high

high