Remote code execution in Microsoft Excel is possible when a user opens a specially crafted workbook, driven by a heap-based buffer overflow. Affected versions include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Office Online Server before 16.0.10417.20228, Microsoft 365 Apps for Enterprise, and the listed macOS Office builds; the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit was identified at time of analysis and no CISA KEV entry is provided, but the mandatory user interaction makes social engineering the practical attack path, and vendor patches are available.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of the current user when a victim opens or previews a specially crafted spreadsheet, making this a genuine high-priority vulnerability for environments running Microsoft Office/Excel. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows no credentials or pre-existing privileges are needed, but because user interaction is required (UI:R) and no non-default configuration is involved, exploitation depends on social engineering - typically a phishing attachment, a malicious link, or a web-hosted document - rather than direct remote triggering. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available per Microsoft's advisory.
Remote code execution in Microsoft Excel can be triggered by a stack-based buffer overflow when a victim opens a specially crafted workbook, allowing arbitrary code in the context of the opening user. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac variants, and Office Online Server; the attack is network-deliverable (AV:N) and requires no authentication (PR:N) but depends on user interaction (UI:R) to open the file. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Opening an attacker-crafted Excel workbook in affected Microsoft 365 Apps for Enterprise, Office 365 for Mac, or Office LTSC for Mac builds can trigger a heap-based buffer overflow (CWE-122) that lets an unauthenticated remote attacker execute code in the context of the victim user, earning a CVSS 3.1 base score of 8.8 (High). Delivery is network-based and requires no credentials or special configuration, but the attacker must persuade the victim to open the malicious file (UI:R), so a successful email attachment or download plus user action is sufficient to reach the vulnerability. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the mandatory user-interaction step means Protected View, Mark-of-the-Web blocking, and attachment filtering remain meaningful brakes despite the high base score.
Remote code execution in Microsoft Office Excel is possible when an unauthenticated attacker convinces a user to open a crafted spreadsheet in an unpatched build, with the underlying flaw being an integer underflow/wraparound in the document parser that corrupts memory. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server below their fixed builds; exploitation requires the user to open and enable content in the malicious document (CVSS UI:R) but needs no credentials or pre-existing privileges on the target (PR:N). No public exploit was identified at time of analysis, and Microsoft has released fixed builds, so this is a genuine patching priority even though the attack hinges on user interaction and is substantially blunted by Protected View and Mark-of-the-Web sandboxing.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated remote attackers to execute arbitrary code when a user opens a crafted media file (UI:R). Affected and unpatched builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers. No public exploit identified at time of analysis, but a vendor patch is available.
Use-after-free memory corruption in Microsoft PowerPoint enables unauthenticated remote attackers to execute arbitrary code on a victim's machine when a maliciously crafted presentation is opened. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no authentication is required, but exploitation depends on the target opening the attacker-supplied file, making email attachments, chat-delivered documents, and shared links the practical delivery vectors. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the macOS Office SKUs; the vendor has released updates, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stack-based buffer overflow in Microsoft GDI+ enables remote code execution in the security context of the current user when a crafted image or document is opened or rendered by the victim. The flaw is remotely deliverable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but exploitation hinges on mandatory user interaction - CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and no public exploit code has been identified at time of analysis, so there is no confirmed actively exploited (CISA KEV) activity. Because GDI+ is a built-in Windows component, the affected surface spans a very broad estate - Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - making this a high-priority patching item on patch-Tuesday cadence rather than an emergency response, with vendor patches already available. CISA SSVC nonetheless rates the technical impact as "total," reflecting the potential for full confidentiality, integrity and availability compromise on an unpatched host.
Remote code execution in Microsoft PowerPoint stems from a use-after-free memory corruption flaw (CWE-416) that an unauthenticated remote attacker can trigger by delivering a maliciously crafted PowerPoint/Office document to a victim, who must then open it (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and the macOS Microsoft 365/Office LTSC releases identified in EUVD-2026-100169. CISA SSVC records exploitation as 'none' and automatable as 'no', so no public exploit identified at time of analysis, and Microsoft has published fixed versions through the MSRC update guide.
Heap-based buffer overflow in Microsoft Office Visio enables remote code execution when a victim opens a maliciously crafted Visio drawing file (CVSS 8.8, CWE-122). The attack is unauthenticated (PR:N) and remotely deliverable (AV:N), but requires user interaction (UI:R): the target must have the separately licensed Visio application installed and must be persuaded to open the attacker-supplied file, typically delivered by phishing email or a hosted download. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; real-world risk is materially reduced by Protected View, Mark-of-the-Web, attachment blocking, and the fact that Visio is not present in most Office installations.
Heap-based buffer overflow in Microsoft Visio allows remote, unauthenticated attackers to execute arbitrary code in the context of the user who opens a specially crafted Visio document. Exploitation is not zero-click: it requires user interaction (UI:R), with the malicious file typically delivered as an email attachment or download link that the victim must open, and no credentials or special target-side configuration are needed (PR:N). No public exploit code or confirmed active exploitation is identified in the available data, no EPSS score was supplied, and Microsoft's MSRC Update Guide is the authoritative reference for fixes.
Out-of-bounds read in Windows Text Shaping allows a remote, unauthenticated attacker to execute code on affected Windows systems when a victim opens or renders attacker-controlled content (UI:R), such as a document, web page, email, or font. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but with a CVSS score of 8.8 and high impact to confidentiality, integrity, and availability, it represents a credible high-priority risk that is not a top-of-queue emergency on current signals.
Command injection in Microsoft OneNote allows an unauthenticated remote attacker to execute code when a victim opens a specially crafted OneNote document. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise 16.0.1 per EUVD, with user interaction being the primary exploitation barrier. No public exploit was identified at time of analysis, and Microsoft has published an advisory and update path via the MSRC update guide.
Heap-based buffer overflow in Microsoft Office Excel lets a remote, unauthenticated attacker execute code when a victim opens or previews a specially crafted Excel workbook in an affected Office build. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/SU/C:H/I:H/A:H means the attacker needs the user to interact with the malicious file, not a server-side or fully unauthenticated service exploit, despite the network attack-vector label. Microsoft has released patches per the MSRC advisory; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stack-based buffer overflow in Microsoft Word affects Office LTSC 2021, Office LTSC 2024, Microsoft 365 Apps for Enterprise, and the Mac editions of Office, allowing a remote attacker to execute code in the context of the victim who opens a specially crafted Word document (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No attacker privileges are required, but exploitation depends on user interaction - typically an email attachment or a web-downloaded document - which is the primary limiting factor and is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has released vendor patches and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Access lets an attacker execute arbitrary code at the privilege level of a user who opens a specially crafted Access database file, scoring CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No credentials or target-side configuration are needed, but the attack chain depends on the victim opening or interacting with the malicious file (UI:R), making file delivery and social engineering the main barrier; Microsoft has published a fix via its update-guide advisory. There is no CISA KEV entry and no public exploit identified at time of analysis, though the high impact across confidentiality, integrity and availability makes prompt patching a genuine priority.
Remote code execution in the Windows RPC Runtime is possible due to an untrusted pointer dereference (CWE-822) that can be triggered when a victim initiates or accepts an RPC connection to an attacker-controlled endpoint. Unauthenticated attackers on the network can exploit this with user interaction (CVSS 8.8, AV:N/AC:L/PR:N/UI:R), affecting a wide range of supported Windows client and server editions. No public exploit or active exploitation has been observed (SSVC Exploitation: none), but vendor patches are available.
Heap-based buffer overflow in Windows Event Tracing (ETW) lets remote attackers execute arbitrary code with high impact to confidentiality, integrity, and availability on unpatched Windows systems, provided a victim performs a user action such as connecting to or opening attacker-controlled network content parsed by the ETW component. No authentication or prior privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but the mandatory user interaction blocks fully automated or wormable spread, consistent with CISA SSVC scoring of Automatable: no and Exploitation: none. No public exploit code or confirmed active exploitation is identified for this CVE at time of analysis, and a vendor patch is available from Microsoft.
The Windows Partition Management Driver contains an out-of-bounds read (CWE-125) that allows unauthenticated remote attackers to execute code on affected Windows 10, Windows 11, and Windows Server 2019/2022/2025 systems, provided they can trick a user into opening, mounting, or processing malicious partition or disk data (UI:R). Vendor patches are available, and no public exploit or confirmed active exploitation has been identified at time of analysis; this is a high-priority patching item but not an emergency.
Remote code execution in Microsoft Remote Desktop Client can be triggered when a victim connects to a malicious or compromised RDP server, exploiting a use-after-free (CWE-416) condition during processing of server responses. The vulnerability requires user interaction (UI:R) - the victim must initiate the RDP connection, for example via a malicious .rdp file or social engineering - but no authentication to the victim's system is needed (PR:N), and it is remotely exploitable with low complexity (AV:N/AC:L). CVSS 3.1 score is 8.8, reflecting high confidentiality, integrity, and availability impact; no public exploit has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Elevation of privilege in Windows NDIS (ndis.sys) allows a local authenticated user to run processes in an elevated context by exploiting an out-of-bounds read caused by a missing buffer-length check. The vulnerability affects all Windows systems with the default NDIS driver, requiring the attacker to already have local access and the ability to execute a malicious application. No public exploit code has been identified at time of analysis, and Microsoft has released a security update to address the flaw.
Remote code execution in Remote Desktop Client can be triggered when a user connects to an attacker-controlled or compromised RDP server, due to a use-after-free in the client. The attacker does not need credentials (PR:N), but the victim must initiate the outbound RDP session (UI:R), so environments that restrict outbound RDP to trusted hosts are less exposed; successful exploitation runs code in the context of the connecting user. No public exploit identified at time of analysis; this is a serious client-side vulnerability but not an emergency because the attacker cannot reach the client unsolicited.
Remote code execution in Windows RPC Runtime (CVSS 8.8) arises from a type confusion flaw (CWE-843) that an unauthenticated attacker can trigger over the network, though exploitation requires user interaction-such as connecting to an attacker-controlled RPC endpoint or processing a malicious server response. No public exploit code has been identified at time of analysis, but the high impact and unauthenticated nature make this a high-priority issue for patching.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the security context of the current user when a victim opens an attacker-supplied workbook, rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication or prior privileges are required, but exploitation is gated by user interaction - the attacker must deliver a malicious Excel file (typically by email, link, or download) and persuade the target to open or preview it, so the AV:N vector reflects file delivery over the network rather than a directly reachable network service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and Microsoft has shipped patched builds for the Windows Office and Office Online Server editions while macOS fixes remain pending publication.
Opening or previewing an attacker-supplied Excel spreadsheet can allow a remote, unauthenticated attacker to run code in the security context of the user who opened the file on affected Windows and macOS Office builds (Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and the corresponding Mac editions). The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so while delivery is remote via email or web, exploitation is gated by user interaction - the victim must open the crafted document - and the resulting impact is bounded by that user's privileges. No public exploit code has been identified at time of analysis and the vendor has released patches, so this is a patching-priority item rather than a confirmed actively exploited or wormable remote flaw.
Heap-based buffer overflow in Microsoft Excel enables remote, unauthenticated attackers to execute arbitrary code in the context of the logged-on user when the victim opens a maliciously crafted Excel document. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector, no credentials or prior access are required and attack complexity is low, with the only meaningful barrier being the mandatory user interaction of opening the file; Microsoft rates this 8.8 High, and a vendor patch is available from Microsoft (MSRC update guide for CVE-2026-97773). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the broad install base of Microsoft 365 Apps and Office LTSC makes prompt patching important. This is a credible high-priority issue.
Remote code execution in Microsoft Excel affects Office LTSC 2021, LTSC 2024, Office Online Server, Microsoft 365 Apps, and Mac editions when a victim opens a specially crafted spreadsheet (UI:R). An unauthenticated attacker (PR:N) can trigger a double free (CWE-415) to corrupt memory and execute code in the context of the user; no public exploit has been identified. Although high severity (CVSS 8.8), exploitation requires user interaction and is not zero-click, and vendor patches are available.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine when the victim opens a maliciously crafted spreadsheet, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. The defect is a use-after-free memory-corruption issue (CWE-416) rated CVSS 8.8 with full impact to confidentiality, integrity, and availability, but exploitation hinges on the user-interaction prerequisite (CVSS UI:R) of opening the file - it is not a remote code path that fires without a user action. No public exploit code has been identified and there is no CISA KEV confirmation of active exploitation at time of analysis; vendor patches are available, so this is a high-priority but not currently urgent-tier issue given the absence of exploitation signals.
Stack-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code in the context of the user who opens or previews a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, corresponding Mac editions, and Office Online Server; exploitation requires user interaction (UI:R), and no public exploit was identified at time of analysis. Vendor patches are available, with fixed builds such as 16.0.17932.21056 for Office LTSC 2024.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the context of the user who opens a specially crafted spreadsheet. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), no authentication or prior privileges are required, but exploitation is conditional on the victim opening the malicious file - there is no zero-click path, which is the defining prerequisite and the primary limiting factor. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021 (Windows and Mac), Office LTSC/365 for Mac, and Office Online Server; there is no public exploit identified at time of analysis, and no CISA KEV listing, though Microsoft has published a vendor fix.
Heap-based buffer overflow in Microsoft Excel allows remote code execution when a victim opens an attacker-crafted spreadsheet in a vulnerable build, including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office for Mac, and Office Online Server. The attack is unauthenticated from the attacker's side but requires user interaction (UI:R), meaning the target must open or preview the file, after which code executes in that user's security context. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though vendor patches are available and should be treated as a high-priority patch item.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to compromise affected systems when a victim opens or previews a maliciously crafted workbook. This heap-based buffer overflow affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, and Office Online Server; a vendor patch is available. No public exploit code has been identified at time of analysis, and while exploitation requires user interaction, the vulnerability is high priority but not an emergency 'patch-tonight' situation.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows and Mac, Office 365 for Mac, and Office Online Server) allows an unauthenticated remote attacker to execute code with the victim's privileges by convincing them to open or preview a specially crafted workbook. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, and exploitation hinges on the required user interaction (CVSS UI:R); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has released patches-Office LTSC 2024 16.0.17932.21056, Office LTSC 2021 16.0.14334.20974, and Office Online Server 16.0.10417.20228-making this a genuine patch-priority item but not a drop-everything emergency.
Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute code by convincing a user to open a specially crafted Excel file. Exploitation requires user interaction and can be blocked by Protected View, but the high impact (CVSS 8.8) makes patching a high priority even though no public exploit has been identified at the time of analysis.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code in the context of the user who opens a maliciously crafted workbook, with the file delivered over the network (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and Office LTSC for Mac; no public exploit identified at time of analysis, and vendor patches remove the condition.
Use-after-free in Microsoft Excel enables remote code execution when a victim opens an attacker-crafted workbook; the attacker needs no authentication (PR:N) but must convince the user to open the file (UI:R), as reflected in the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Successful exploitation runs code in the context of the opening user with high confidentiality, integrity, and availability impact, and default Excel configurations on the listed builds are affected. Vendor patches are available with specific fix builds (e.g., 16.0.14334.20974 for Office LTSC 2021, 16.0.17932.21056 for Office LTSC 2024, and 16.0.10417.20228 for Office Online Server), and no public exploit code was identified at time of analysis, making this a genuine high-priority patch-worthy issue but not an emergency at the time of analysis.
Stack-based buffer overflow in Microsoft Excel enables remote code execution against affected builds when a victim opens an attacker-crafted spreadsheet; the memory-corruption flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials or prior access are needed, but successful exploitation hinges entirely on the target user opening the malicious document. Exposure spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, Office LTSC 2021/2024 and Office 365 for Mac, and Office Online Server running builds below the fixed versions enumerated in ENISA EUVD-2026-99809. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a vendor fix through its Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97750), which keeps this a high-priority but manageable patch-now item rather than an emergency.
Heap-based buffer overflow in Microsoft Excel enables remote attackers to execute code on a victim's machine with the privileges of the affected Office process by convincing a user to open or preview a specially crafted workbook (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). Because the vector shows PR:N, no credentials or elevated privileges are needed, but the UI:R requirement means the bug cannot self-propagate and depends on social engineering to deliver and open the malicious file across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, Office LTSC for Mac 2021/2024, Office 365 for Mac, and Office Online Server, all of which have vendor-supplied fixes. Microsoft has published a security update (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97748), and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven by unpatched, high-exposure Office deployments and phishing-delivered workbooks rather than by an observed campaign.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code by convincing a victim to open a maliciously crafted Excel file. This use-after-free vulnerability (CWE-416) affects multiple Excel versions, including Office LTSC 2024, Office LTSC 2021, and Office Online Server, with a CVSS score of 8.8. No public exploit or active exploitation has been identified, and while it is not a zero-click emergency, patching is strongly recommended.
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted spreadsheet, because an integer underflow (CWE-191) in Office's document handling wraps a value and leads to memory corruption exploitable for code execution in the context of the opening user. No authentication is required on the target (PR:N) and the file can be delivered over the network via email, a link, or a shared document, but exploitation depends on the victim opening the file (UI:R), and no server-side or zero-click path is indicated. Microsoft has released fixed builds (for example Office LTSC 2021 16.0.14334.20974 and Office LTSC 2024 16.0.17932.21056), and no public exploit identified at time of analysis; treat this as a high-priority, patch-worthy issue rather than an emergency given the absence of exploitation signals.
Remote code execution in Microsoft Excel stems from a use-after-free memory corruption flaw (CWE-416) that an unauthenticated attacker can trigger by convincing a victim to open a specially crafted Excel workbook. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server, with the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicating low-complexity, network-delivered exploitation that requires no attacker credentials but does require the victim to open the malicious file. Successful exploitation yields code execution in the security context of the user who opened the document, and while no public exploit has been identified at time of analysis, the flaw is vendor-confirmed, rated 8.8, carries an official Microsoft patch, and is considered a credible, actionable priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code in the context of the user who opens or previews a specially crafted workbook, affecting Microsoft Office LTSC 2021 and 2024, Microsoft 365 Apps for Enterprise, Office for Mac, and Office Online Server. The attack requires user interaction (UI:R) and no authentication (PR:N), with code executing at the user's privilege level rather than elevated; phishing or social engineering is the realistic delivery path. A vendor patch is available, and no public exploit has been identified at time of analysis.
Remote code execution in Microsoft Outlook results from a stack-based buffer overflow triggered when a victim opens or previews a maliciously crafted email/message. The flaw affects Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise, with CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) and no privileges required. This is a high-priority issue, though not the absolute top tier of urgency, because user interaction is required; no public exploit identified at time of analysis, and vendor patches are available.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code on a victim's system when the user opens a specially crafted Excel document. Affected versions include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and 2021 for Windows and Mac. A vendor patch is available, but no public exploit code has been identified at time of analysis; the mandatory user interaction and Protected View gating make this a patch-priority item rather than an emergency.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and the corresponding Mac builds) is possible when an unauthenticated attacker convinces a victim to open a specially crafted Excel workbook. The root cause is a use-after-free (CWE-416) memory-corruption condition that the crafted file triggers inside Excel's parsing/handling logic, giving the attacker code execution in the context of the user, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The decisive limiting factor is mandatory user interaction: there is no zero-click or server-side trigger in the assessed vector, and no public exploit code has been identified at time of analysis. Vendor patches are available, and the MSRC update guide should be treated as the authoritative reference.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine if the user opens a specially crafted spreadsheet that triggers a buffer underwrite (CWE-124) in Excel's file-parsing path. The flaw carries a CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is fully remote with no privileges required, but the mandatory user interaction (UI:R) is the key limiting factor - the attack cannot fire unless the malicious workbook is opened, so Protected View, Mark-of-the-Web enforcement and user awareness materially reduce real-world exposure. Affected software covers Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021 on Windows and Mac, and Office Online Server; vendor patches are available per Microsoft's advisory, and no public exploit was identified at time of analysis. By signal convergence this is a genuine high-priority vulnerability, but with no confirmed active exploitation and an interaction prerequisite it is not an emergency.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and Office for Mac. Exploitation requires user interaction (UI:R) and no public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code when a victim opens or previews a crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. No public exploit code has been identified at time of analysis, but the CVSS score of 8.8 and low attack complexity make this a credible, actionable priority; vendor patches are available. Code execution occurs in the context of the user who opens the file, and user interaction is required.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code in the context of the opening user when a crafted workbook is opened or previewed (user interaction required). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 for Windows and Mac, Office 365 for Mac, and Office Online Server. No public exploit has been identified at time of analysis, and Microsoft has released patches; risk is high but not a top-tier emergency given the reliance on social engineering.
Heap-based buffer overflow in Microsoft Word enables unauthenticated remote attackers to execute arbitrary code if a victim opens a crafted document. The flaw affects Microsoft Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac; a vendor-released patch is available. No public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and automatable as no, reflecting the required user interaction.