Microsoft Office Spoofing Vulnerability
Priority LOW 35CWE-284Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.
Summary
Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00222 12th percentileScored 2026-11-07
Fix Fixed Microsoft Excel for Android (Microsoft): 16.0.19822.20190Microsoft Office LTSC for Mac 2021 (Microsoft): 16.109.26051019+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft Excel for Android | 16.0.0.0 to before 16.0.19822.20190 | 16.0.19822.20190 | Patch available | CNA |
| Microsoft | Microsoft Office LTSC for Mac 2021 | 16.0.1 to before 16.109.26051019 | 16.109.26051019 | Patch available | CNA |
| Microsoft | Microsoft Office LTSC for Mac 2024 | 16.0.0 to before 16.109.26051019 | 16.109.26051019 | Patch available | CNA |
| Microsoft | Microsoft Word for Android | 16.0.0.0 to before 16.0.19822.20190 | 16.0.19822.20190 | Patch available | CNA |
- Microsoft Excel for Android VendorMicrosoft Affected 16.0.0.0 to before 16.0.19822.20190 Fixed in 16.0.19822.20190 Patch available CNA
- Microsoft Office LTSC for Mac 2021 VendorMicrosoft Affected 16.0.1 to before 16.109.26051019 Fixed in 16.109.26051019 Patch available CNA
- Microsoft Office LTSC for Mac 2024 VendorMicrosoft Affected 16.0.0 to before 16.109.26051019 Fixed in 16.109.26051019 Patch available CNA
- Microsoft Word for Android VendorMicrosoft Affected 16.0.0.0 to before 16.0.19822.20190 Fixed in 16.0.19822.20190 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:excel:*:*:*:*:*:android:*:* | before 16.0.19822.20190 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2024:*:*:*:ltsc:macos:*:* | 2024 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:* | 2021 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:*:*:*:*:*:android:*:* | before 16.0.19822.20190 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:excel:*:*:*:*:*:android:*:* Versions before 16.0.19822.20190 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2024:*:*:*:ltsc:macos:*:* Versions 2024 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:* Versions 2021 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:*:*:*:*:*:android:*:* Versions before 16.0.19822.20190 Vulnerable ·Microsoft
Remediation
- Fix · CNA Microsoft Excel for Android (Microsoft) Fixed in 16.0.19822.20190
- Fix · CNA Microsoft Office LTSC for Mac 2021 (Microsoft) Fixed in 16.109.26051019
- Fix · CNA Microsoft Office LTSC for Mac 2024 (Microsoft) Fixed in 16.109.26051019
- Fix · CNA Microsoft Word for Android (Microsoft) Fixed in 16.0.19822.20190
Vendor assessments
Microsoft
Microsoft's page for this CVE →
- Impact
- Spoofing
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Unlikely
| Product | Status | Plan or fix |
|---|---|---|
| Microsoft Excel for Android | Fixed | 16.0.19822.20190 · Security Update |
| Microsoft Office LTSC for Mac 2021 | Fixed | 16.109.26051019 · Security Update |
| Microsoft Office LTSC for Mac 2024 | Fixed | 16.109.26051019 · Security Update |
| Microsoft Word for Android | Fixed | 16.0.19822.20190 · Security Update |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42832
- 2026-10-03 Alias added: GHSA-857p-384w-97mc
References
More Microsoft Excel vulnerabilities
- TI-2019-01013 A remote code execution vulnerability exists in Microsoft Excel software when the… KEVCVSS 3.1HIGH 8.8
- TI-2009-00222 Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold… KEVCVSS 3.1HIGH 8.8
- TI-2007-00655 Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and… KEVCVSS 3.1HIGH 8.8
- TI-2021-18725 Microsoft Excel Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
- TI-2016-06250 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016… KEVCVSS 3.1HIGH 7.8
- TI-2009-02984 Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for… KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2026-42832 · CVE Program
- CVE-2026-42832 · NVD
- FIRST EPSS
- GHSA-857p-384w-97mc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-42832 · Microsoft Security Update Guide
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences