Read the docs
TI-2026-33393 Aliases CVE-2026-45649GHSA-4363-fqg7-xrx3

Office for Android Spoofing Vulnerability

Priority LOW 34CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00428 37th percentileScored 2026-11-07
Fix Fixed Microsoft Excel for Android (Microsoft): 16.0.20131.20024Microsoft PowerPoint for Android (Microsoft): 16.0.20131.20024+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Excel for Android16.0.0.0 to before 16.0.20131.2002416.0.20131.20024Patch availableCNA
MicrosoftMicrosoft PowerPoint for Android16.0.0.0 to before 16.0.20131.2002416.0.20131.20024Patch availableCNA
MicrosoftMicrosoft Word for Android16.0.0.0 to before 16.0.20131.2002416.0.20131.20024Patch availableCNA
  • Microsoft Excel for Android VendorMicrosoft Affected 16.0.0.0 to before 16.0.20131.20024 Fixed in 16.0.20131.20024 Patch available CNA
  • Microsoft PowerPoint for Android VendorMicrosoft Affected 16.0.0.0 to before 16.0.20131.20024 Fixed in 16.0.20131.20024 Patch available CNA
  • Microsoft Word for Android VendorMicrosoft Affected 16.0.0.0 to before 16.0.20131.20024 Fixed in 16.0.20131.20024 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:excel:-:*:*:*:*:android:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:powerpoint:-:*:*:*:*:android:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:word:-:*:*:*:*:android:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:a:microsoft:excel:-:*:*:*:*:android:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:powerpoint:-:*:*:*:*:android:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:word:-:*:*:*:*:android:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft Excel for Android (Microsoft) Fixed in 16.0.20131.20024
  • Fix · CNA Microsoft PowerPoint for Android (Microsoft) Fixed in 16.0.20131.20024
  • Fix · CNA Microsoft Word for Android (Microsoft) Fixed in 16.0.20131.20024

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Spoofing
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Unlikely
ProductStatusPlan or fix
Microsoft Excel for AndroidFixed 16.0.20131.20024 · Security Update
Microsoft PowerPoint for AndroidFixed 16.0.20131.20024 · Security Update
Microsoft Word for AndroidFixed 16.0.20131.20024 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45649
  2. 2026-10-03 Alias added: GHSA-4363-fqg7-xrx3

References

Patch 1

  • TI-2019-01013 A remote code execution vulnerability exists in Microsoft Excel software when the… KEVCVSS 3.1HIGH 8.8
  • TI-2009-00222 Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold… KEVCVSS 3.1HIGH 8.8
  • TI-2007-00655 Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and… KEVCVSS 3.1HIGH 8.8
  • TI-2021-18725 Microsoft Excel Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
  • TI-2016-06250 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016… KEVCVSS 3.1HIGH 7.8
  • TI-2009-02984 Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for… KEVCVSS 3.1HIGH 7.8
See all 501 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences