{"id":"CVE-2026-124183","kind":"vulnerability","aliases":["CVE-2026-124183"],"related":[],"title":"Microsoft Excel: buffer over-read lets a network attacker disclose information","description":"Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.","summary":"A buffer over-read in Microsoft Office Excel lets an unauthorized attacker read memory beyond the intended buffer over the network. The attacker can disclose information, but the sources do not say that code runs or that data is changed.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["excel","microsoft-office","other","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:47+00:00","first_seen_at":"2026-11-10T19:25:13+00:00","triaged_at":"2026-11-10T19:56:15+00:00","updated_at":"2026-11-10T19:56:15+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T19:56:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Excel: buffer over-read lets a network attacker disclose information","impact":"low","summary":"A buffer over-read in Microsoft Office Excel lets an unauthorized attacker read memory beyond the intended buffer over the network. The attacker can disclose information, but the sources do not say that code runs or that data is changed.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","excel","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads sensitive memory contents over the network","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-124183 for affected Excel builds, required user interaction and the patch version.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that run Microsoft Office Excel are exposed to this flaw. The sources do not say which Excel versions, file types or network paths are involved, so the unknown details are not stated here.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":4491,"output_tokens":429,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124183':15A,18A '-2026':14A,17A 'allow':74C 'attack':10A,37B,48B,77C 'beyond':40B 'buffer':3A,26B,43B,66C 'chang':65B 'code':59B 'cve':13A,16A 'data':63B 'disclos':11A,50B,79C 'excel':2A,19B,33B,73C 'inform':12A,51B,80C 'intend':42B 'let':7A,34B 'memori':39B 'microsoft':1A,21B,31B,71C 'microsoft-offic':20B 'network':9A,46B,83C 'offic':22B,32B,72C 'over-read':4A,27B,67C 'read':6A,29B,38B,69C 'run':60B 'say':57B 'sourc':54B 'unauthor':36B,76C 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Organizations that run Microsoft Office Excel are exposed to this flaw. The sources do not say which Excel versions, file types or network paths are involved, so the unknown details are not stated here.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["excel","medium","microsoftoffice","other","windows"],"campaign_type":null,"search_a":"'-124183':15A,18A '-2026':14A,17A 'attack':10A 'buffer':3A 'cve':13A,16A 'disclos':11A 'excel':2A 'inform':12A 'let':7A 'microsoft':1A 'network':9A 'over-read':4A 'read':6A","search_b":"'attack':37B,48B 'beyond':40B 'buffer':26B,43B 'chang':65B 'code':59B 'data':63B 'disclos':50B 'excel':19B,33B 'inform':51B 'intend':42B 'let':34B 'memori':39B 'microsoft':21B,31B 'microsoft-offic':20B 'network':46B 'offic':22B,32B 'over-read':27B 'read':29B,38B 'run':60B 'say':57B 'sourc':54B 'unauthor':36B 'window':24B","search_c":"'allow':74C 'attack':77C 'buffer':66C 'disclos':79C 'excel':73C 'inform':80C 'microsoft':71C 'network':83C 'offic':72C 'over-read':67C 'read':69C 'unauthor':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124183","severity":null,"published_at":"2026-11-10T19:20:47+00:00","modified_at":"2026-11-10T19:20:47+00:00","first_seen_at":"2026-11-10T19:25:13+00:00","fetched_at":"2026-11-10T19:25:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}