Remote code execution in Microsoft Windows WebDAV lets a low-privileged, authenticated attacker reach the code-execution path over the network by exploiting improper resolution of path equivalence (CWE-41), yielding high confidentiality, integrity and availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8). The flaw spans supported Windows client and server releases from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, but only where the WebDAV/WebClient capability is enabled and network-reachable, since that service is not on by default across all SKUs and exploitation requires an existing low-privileged account. There is no public exploit code and no confirmed active exploitation at time of analysis (CISA SSVC exploitation: none); vendor patches that lift the affected builds above the enclosed fix levels are available from Microsoft. Note that source tagging labels this issue Information Disclosure, which understates the assessed code-execution impact.
Privilege elevation in the Windows Encrypting File System (EFS) lets an authenticated remote attacker supply an absolute path that EFS resolves outside its intended directory, yielding high impact across confidentiality, integrity, and availability (CVSS 8.8, CWE-36). Every supported Windows client and server generation is affected - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - while exploitation requires the attacker to already hold valid low-privilege credentials and network reachability to the EFS service (PR:L, AV:N), with no user interaction needed. No public exploit code and no confirmed active exploitation have been identified at time of analysis per CISA's SSVC (Exploitation: none, Automatable: no), though the assessed technical impact is total; Microsoft has shipped vendor patches.
Relative path traversal in OpenSSH for Windows (CWE-23) can allow an unauthenticated remote attacker to escape intended directories during an SSH interaction and, ultimately, execute code on the affected host - carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and rated by SSVC as having total technical impact. Exploitation is not attacker-autonomous: it requires the victim to use the OpenSSH for Windows component and to initiate or accept an SSH connection to an attacker-controlled or compromised endpoint (the UI:R user-interaction requirement), and the host must be running a build below its fixed release (for example Windows 11 24H2 below 10.0.26100.9711 or Windows Server 2022 below 10.0.20348.5761). Current intelligence shows no public exploit identified at time of analysis, SSVC exploitation status of 'none', and non-automatable delivery, so this is a high-priority-on-paper issue whose real-world urgency is tempered by the lack of confirmed exploitation - vendor patches are available per the Microsoft advisory and should still be prioritized.
Memory corruption in the Windows DNS Server role allows an authorized, low-privileged attacker who can reach the DNS service over the network to execute arbitrary code in the context of the DNS service. The flaw is a release of an invalid pointer or reference (CWE-763) rated CVSS 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction, low attack complexity, net-unauthenticated reachability but a low-privilege prerequisite (PR:L) matching Microsoft's 'authorized attacker' wording. Exposure is limited to hosts that actually run the DNS Server role - Windows Server 2012 through 2025 (including Server Core installations) and Windows 10/11 builds with the role enabled - and at the time of analysis there is no public exploit code identified and CISA's SSVC assessment records exploitation as 'none', so this is a high-priority hardening item for DNS-hosting infrastructure rather than an emergency drop-everything event. Vendor patches are available, and the underlying build-level fixes are enumerated in the affected-version data below.
Stack-based buffer overflow in Windows DHCP Server allows an authenticated attacker with low-level network privileges to run arbitrary code on unpatched Windows Server and Windows 10 systems where the DHCP Server service is present. The flaw is network-reachable, low-complexity, and needs no user interaction, but PR:L means the attacker must already have an authenticated foothold; CISA SSVC rates exploitation as none and not automatable, and no public exploit code is identified at time of analysis. Vendor patches are available, making this a serious flaw to prioritize on exposed DHCP servers rather than an immediate emergency.
Heap-based buffer overflow in the Microsoft PostScript Printer Driver allows an authorized, authenticated attacker (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N, base score 8.8) to deliver crafted PostScript content over a network path the driver processes and achieve code execution with high confidentiality, integrity, and availability impact. The driver ships by default with supported Windows 10, Windows 11 (22H2 through 26H2), and Windows Server 2012 through 2025 builds enumerated in the EUVD data, so exposure is broad, but exploitation is gated on the attacker already holding valid credentials on the target or a system in the print path; no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and the assessed technical impact is total, making this a serious but not emergency-tier issue that should be remediated on a normal patch cadence.
Improper path-equivalence handling in Microsoft Windows SmartScreen allows an unauthenticated, remote attacker to bypass the reputation/Mark-of-the-Web check so that a crafted file runs without the expected SmartScreen warning, provided the victim opens it (user interaction required, CVSS 8.8). Only unpatched Windows 11 builds are affected - 24H2 before 10.0.26100.9711, 25H2 before 10.0.26200.9711, 26H1 before 10.0.28000.3231, and 26H2 before 10.0.26300.9711; no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' and not automatable, so urgency signals conflict between the high CVSS score and total technical impact and the absence of observed or automated exploitation. A vendor patch is available and should be applied through the normal Windows update channel.
Deserialization of untrusted data in Microsoft SQL Server (SQL Server 2019, 2022, and 2025 GDR/CU builds) allows an attacker to achieve remote code execution with high confidentiality, integrity, and availability impact. Exploitation requires the attacker to already hold valid low-privilege authenticated access to the target instance (CVSS PR:L) plus network reachability (AV:N), with no user interaction (UI:N), so credential-less external attackers cannot exploit it directly; realistic risk concentrates on instances reachable by untrusted or lower-trust database users, such as multi-tenant applications, service accounts, or internal users. CISA's SSVC evaluation rates exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis, but the technical impact is rated total. Microsoft has released fixed builds for every affected branch.
An out-of-bounds write in Active Directory Domain Services (AD DS) lets an authenticated, low-privileged attacker who can reach a domain controller over the network execute arbitrary code in the context of the directory service, with total loss of confidentiality, integrity, and availability per the CVSS 8.8 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds as well as Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) installations that host the AD DS component, including Server Core deployments. Exploitation requires a valid domain credential and domain-controller reachability, and there is no public exploit identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), but vendor-released patches are available and the assessed technical impact is total, so domain controllers should be patched on a priority basis.
Memory corruption in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged attacker to execute arbitrary code over the network, with a CVSS 3.1 base score of 8.8 reflecting high confidentiality, integrity, and availability impact. Because BITS is a default-enabled core component of every supported Windows client and server edition listed in the EUVD data, no feature toggle has to be turned on for exposure - but the CVSS vector's PR:L metric means the attacker must already hold a low-privileged foothold, and CISA's SSVC assessment marks the flaw as not automatable, so no wormable mass-exploitation path is indicated. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor patches are available, making this a high-priority but not emergency-outbreak patching target.
Heap-based buffer overflow in the Windows Distributed File System (DFS) allows an authenticated, network-positioned attacker to execute arbitrary code on a vulnerable host, carrying high confidentiality, integrity, and availability impact (CVSS 8.8). Affected platforms span Windows Server 2012 through Server 2025 and Windows 10/11 builds below the fixed builds catalogued by ENISA EUVD, and exploitation requires valid network-accessible credentials (PR:L per the CVSS vector) plus reachability to the DFS service - the authentication requirement and the absence of user interaction are the two defining gates. Exploitation status is currently benign: CISA's SSVC assessment rates Exploitation as none and Automatable as no, there is no KEV listing, and no public exploit identified at time of analysis, so the practical urgency is lower than the raw 8.8 score suggests.
Type confusion in the DNS Server role on Windows Server 2022 and Windows Server 2025 lets an authenticated, low-privileged attacker who can reach the DNS service over the network execute arbitrary code with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw affects Windows Server 2022 builds below 10.0.20348.5761 and Windows Server 2025 builds below 10.0.26100.33650 (including Server Core installations) where the DNS Server role is enabled and network-reachable. Microsoft has released fixes, and there is no public exploit identified at time of analysis and no CISA KEV listing; CISA's SSVC assessment rates exploitation as none and automation as no, though technical impact is rated total, so this is a genuine high-priority issue rather than an emergency remote unauthenticated attack.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10, Windows 11 and Windows Server 2012 through 2025 hosts on which the RRAS role is installed, with the CVSS 3.1 vector (8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating a network-reachable attacker who already holds a low-privilege authenticated position, requires no user interaction, and can achieve full confidentiality, integrity and availability impact. The defect is a double free (CWE-415) memory-corruption condition in the service, which Microsoft has addressed in its monthly update with fixed builds published for each supported branch. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, and real-world exposure is materially narrowed because RRAS is not enabled by default on standard Windows installations.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a valid low-privileged account run code in the context of the ColdFusion service, with no interaction required from any user. The underlying defect is improper input validation (CWE-20) reachable over the network, scored CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - the only significant barrier is that the attacker must first authenticate with low privileges, so exposure is greatest where ColdFusion login interfaces are reachable from untrusted networks or where weak or shared low-privilege accounts exist. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, which keeps this a high-priority patching item rather than an emergency incident.
Heap-based buffer overflow in the Windows Media Video Decoder allows remote, unauthenticated attackers to achieve code execution when a victim opens or renders a specially crafted Windows Media Video file. Exploitation is gated by the user-interaction requirement (CVSS UI:R) - the decoder is a standard, default-installed Windows component with no special configuration needed, so the realistic risk is bounded by delivery and social-engineering success rather than by access controls. No public exploit code or evidence of active exploitation has been identified at time of analysis (no CISA KEV listing), and no EPSS score was supplied; the overflow yields full confidentiality, integrity, and availability impact (CVSS 8.8) if triggered successfully.
Code execution in Microsoft Excel can be triggered when a victim opens or previews an attacker-crafted workbook, exploiting a use-after-free (CWE-416) in file parsing. The flaw is remotely reachable with low complexity and no privileges per CVSS (PR:N), but requires user interaction (UI:R), so exploitation depends on file delivery and social engineering rather than self-propagation. No public exploit was identified at time of analysis and no CISA KEV confirmation was provided; the risk is high-priority but not an automatic emergency given the user-interaction requirement.
Heap-based buffer overflow in Microsoft Excel enables an unauthenticated, remote attacker to execute arbitrary code in the context of the victim user, provided the victim opens or previews a specially crafted Excel workbook (CVSS 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation depends on social engineering to deliver the malicious file, and default Office protections such as Protected View and Mark-of-the-Web meaningfully reduce real-world risk. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and signals are moderately strong but not top-tier urgent.
Use-after-free memory corruption in Microsoft Office Excel allows remote, unauthenticated attackers to execute arbitrary code in the context of the user who opens a crafted spreadsheet (CVSS 3.1 base 8.8, High; AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is client-side and hinges on user interaction: the victim must open or preview an attacker-supplied Excel document, so delivery depends on a social-engineering lure (email attachment, hosted file, or file-share link) and resulting code runs only at the privilege level of the opening user. No public exploit code and no confirmed active exploitation (CISA KEV) were identified in the available intelligence at time of analysis, and Protected View plus Mark-of-the-Web handling of files from untrusted sources materially constrains realistic exploitation.
Out-of-bounds read in Microsoft Excel allows a remote, unauthenticated attacker to execute arbitrary code when a victim opens a maliciously crafted spreadsheet. The vulnerability requires user interaction (CVSS UI:R) and stems from improper input validation (CWE-20); successful exploitation can fully compromise confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the high CVSS score (8.8) and the lack of a confirmed fixed version in the provided data make this a high-priority patching item.
Heap-based buffer overflow in Microsoft's Windows Remote Desktop Client (mstsc.exe) lets an unauthorized remote attacker execute code over a network when a victim connects outbound to a malicious or compromised RDP server, per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8). Because the vulnerable component is the client rather than a listening service, exploitation is not automatable against passive hosts - it hinges on user action such as opening a crafted .rdp file or following a malicious connection prompt, which is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has published fixes and no public exploit code has been identified at time of analysis; the issue is a high-priority patching item but not an emergency drop-everything event.
Stack-based buffer overflow in Microsoft Windows Error Reporting (WER) allows a remote, unauthenticated attacker to execute code in the context of the affected component, though exploitation requires the victim to open or trigger processing of attacker-supplied content, as reflected by the CVSS UI:R metric. The exposure is unusually broad: Windows 10 and Windows 11 up to 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 at the pre-patch build numbers catalogued by ENISA EUVD, are all listed as affected. CISA's SSVC assessment rates exploitation as none and automatable as no, no public exploit code has been identified at time of analysis, and Microsoft has released vendor patches that fully address the issue on updated builds.
Type confusion in the Windows DNS Server role enables unauthenticated remote attackers to execute arbitrary code on affected systems, but exploitation requires user interaction (UI:R) - the DNS server must be induced to process a maliciously crafted record or response. Affected builds include Windows Server 2012 through Server 2025 and Windows 10/11 client installations prior to the patched build numbers listed in Microsoft’s advisory. Microsoft has released patches, and no public exploit or active exploitation has been identified at the time of analysis (SSVC exploitation: none).
Heap-based buffer overflow in the Windows Imaging Component (WIC) allows unauthenticated attackers to execute arbitrary code when a victim opens or previews a specially crafted image file (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Because WIC is a default Windows component, every affected build from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through Server 2025 is potentially exposed, although the mandatory user interaction (UI:R) means delivery depends on social engineering and CISA SSVC records Automatable=no. No public exploit code and no active exploitation have been identified at time of analysis, and Microsoft has published a vendor patch through its update guide. This is a credible high-priority patching item rather than an emergency, driven by total technical impact (C:H/I:H/A:H) but gated by required user interaction.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) allows a remote, unauthenticated attacker to achieve arbitrary code execution in the context of the affected process when a victim opens, plays, or even previews an attacker-crafted media file; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) confirms no privileges are required but that successful exploitation depends on the target rendering the malicious media. Every supported Windows client and server build below the patched build thresholds in this advisory is affected, including Windows 10 21H2/22H2/1809/1607, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations. No public exploit code has been identified and there is no CISA KEV listing, so this is a credible patch-priority item rather than an emergency, but the broad install base and the fact that media files are routinely auto-previewed in Explorer, Outlook and Teams should drive prompt patching.
Privilege escalation in Windows OLE DB allows an unauthenticated remote attacker to elevate to SYSTEM by inducing a victim to open a crafted file or connect to an attacker-controlled data source that a vulnerable OLE DB provider parses, causing a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms authentication is not required, but user interaction is mandatory - there is no zero-click network path, which is the main limiting factor. All default Windows installations are affected across Windows 10, Windows 11 (22H2 through 26H2) and Windows Server 2012 through 2025 including Server Core; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, so this is a high-priority patch item rather than an emergency.
A heap over-read in the Windows Client Side Caching driver (csc.sys) allows an attacker to disclose sensitive memory contents, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds prior to the vendor's fixed revisions. Microsoft's advisory carries a CVSS 8.8 score with a network, user-interaction vector (AV:N/PR:N/UI:R), whereas the independent assessment bounds the flaw to an authorized attacker who already holds local access on the host (AV:L/PR:L/UI:N) - a material conflict that should be resolved against the vendor advisory before prioritization. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC record lists exploitation as 'none' and automatable as 'no', and no EPSS score was supplied.
Heap-based buffer overflow in Microsoft Windows GDI (CWE-122) lets remote attackers achieve code execution on a fully updated-adjacent target by convincing a user to open or preview a maliciously crafted image or document that is parsed through the Windows Graphics Device Interface; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) indicates no authentication is needed but that the victim must interact with the attacker-supplied file. Code execution occurs in the security context of the user who opened the file, so the impact is bounded by that user's privileges and no scope change occurs. No public exploit code has been identified at time of analysis and the CISA SSVC decision framework records Exploitation: none with Automatable: no, while Technical Impact is rated total; there is no KEV listing, so this is a high-priority patching item rather than an emergency. Microsoft has published fixed builds covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Privilege elevation on unpatched Windows hosts is possible through a heap-based buffer overflow (CWE-122) in the Client-Side Caching (CSC) / Offline Files service, which caches content fetched from SMB network shares. The assessed vector (AV:N/AC:L/PR:N/UI:R) describes an unauthenticated remote attacker, but success hinges on a victim interacting - typically by connecting to or accessing an attacker-controlled share so CSC parses a crafted response and overflows a heap buffer - which is consistent with SSVC rating automatic exploitation as 'no' and with the SSVC exploitation signal of 'none'. Microsoft has released patches for every affected build, and no public exploit code has been identified at time of analysis, so this is a serious but not emergency-grade issue demanding prompt, scheduled patching rather than crisis response.
Remote code execution in Microsoft's Internet Messaging API affects unpatched Windows 10, Windows 11, and Windows Server installations, where a heap-based buffer overflow lets an unauthenticated attacker execute code by delivering a specially crafted message. Exploitation is network-reachable without credentials (AV:N, PR:N), but the victim must open or preview the malicious content (UI:R), so unattended services are not directly triggerable, and success yields full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment records Exploitation: none with Automatable: no, though Technical Impact is rated total - making this a credible, high-priority patching target rather than an emergency.
Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute arbitrary code when a victim opens a specially crafted Excel document, affecting Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Microsoft 365 Apps for Enterprise, and corresponding Mac editions. Exploitation requires user interaction (opening a malicious file) and no public exploit or active exploitation is currently identified, per SSVC (Exploitation: none). Vendor patches are available, and code execution occurs only with the privileges of the user who opens the file.
Heap-based buffer overflow in Microsoft Word lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens a specially crafted document, affecting Office LTSC 2021 and LTSC 2024, Microsoft 365 Apps for Enterprise, and the Office LTSC/365 for Mac channels. Because the flaw triggers only when the victim opens the malicious file (CVSS UI:R) and SSVC marks it non-automatable, exploitation depends on social engineering rather than automated mass attacks, even though a successful hit yields total loss of confidentiality, integrity and availability (CVSS 8.8). A vendor patch is available; no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Microsoft Word allows remote code execution when a user opens or previews a specially crafted document. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, and Office LTSC for Mac 2021/2024 plus Office 365 for Mac, with a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and total technical impact per CISA's SSVC. Exploitation requires the victim to open the malicious document (UI:R), so it is not reachable through passive network traffic or automated scanning, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; vendor patches are available and should be prioritized given the high impact.
Heap-based buffer overflow in Microsoft Word allows remote attackers to execute code in the context of the user who opens a crafted Word document. Exploitation requires the victim to open an attacker-supplied file (CVSS UI:R) and no authentication or prior privileges (PR:N), with code running only in the opening user's context and no privilege escalation (S:U); SSVC marks the attack non-automatable, and no public exploit has been identified at time of analysis. Vendor patches are available, including fixed builds for Office LTSC 2021 and LTSC 2024, with updates for Mac and Microsoft 365 Apps distributed through Microsoft's Office security release channel.
Heap-based buffer overflow in Microsoft Office Outlook (CWE-122) lets a remote, unauthenticated attacker execute arbitrary code in the context of the Outlook process by delivering a specially crafted message or object that the victim must open or render. Affected builds per EUVD-2026-99711 are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 below 16.0.14334.20974, and Microsoft Office LTSC 2024 below 16.0.17932.21056; CVSS 3.1 is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction being the only meaningful barrier. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, and SSVC records Exploitation=none with Automatable=no, so this is a credible mid-to-high priority client-side issue rather than an emergency; no EPSS score was supplied in the feed, so no probabilistic exploitation estimate can be cited.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and corresponding Office for Mac editions when a victim opens a specially crafted document that triggers a heap-based buffer overflow. The attacker is unauthenticated (PR:N), but exploitation requires user interaction (UI:R), and any code runs in the context of the opening user (S:U) without crossing a privilege boundary. Microsoft has released patches; no public exploit identified at time of analysis, so treat this as a high-priority phishing-borne update item rather than a remotely triggerable no-interaction emergency.
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens or previews a specially crafted email or attachment, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. Exploitation is gated by mandatory victim interaction (UI:R) and code runs at the interacting user's privilege level rather than SYSTEM (S:U), so it is a high-priority but not emergency-level issue. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none with total technical impact; vendor-released patches are available. Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (CVSS 8.8); CWE-122; EUVD-2026-99710.
Heap-based buffer overflow in Microsoft Outlook allows remote code execution in the context of the logged-on user when a victim opens or renders a specially crafted email item. Affected builds are Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2024 prior to 16.0.17932.21056; the flaw is network-reachable and requires no authentication on the target (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, rated 8.8, CWE-122). CISA's SSVC assessment records no observed exploitation and non-automatable delivery, and no public exploit code has been identified at time of analysis, so this is a credible high-priority patching item rather than a confirmed emergency - mitigated in practice by mandatory user interaction and user-level (non-admin) execution context.
Remote code execution in Microsoft Excel (CVSS 8.8) becomes possible when an unauthenticated attacker convinces a victim to open a specially crafted spreadsheet, triggering an out-of-bounds read (CWE-125) that can be turned into memory corruption and code execution in the context of the user who opened the file. Affected configurations include Microsoft Office LTSC 2021 below 16.0.14334.20974, Microsoft Office LTSC 2024 below 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and Office 365 for Mac. No public exploit has been identified at time of analysis, CISA's SSVC decision framework records exploitation as none and the issue as not automatable, and vendor-released patches are available, making this a high-priority patch target rather than an emergency.
Remote code execution in Microsoft Excel allows an unauthorized attacker to execute arbitrary code when a victim opens a crafted spreadsheet, per the vendor advisory for CVE-2026-100212. The issue is a use-after-free (CWE-416) reachable over the network with no privileges required (AV:N/PR:N), but exploitation is gated by user interaction (UI:R) and runs in the security context of the user who opens the file (S:U). No public exploit identified at time of analysis, and the independent assessment rates it a credible prioritization candidate but not an emergency.
Heap-based buffer overflow in Microsoft Office Excel lets an unauthenticated remote attacker execute arbitrary code on a target system when the victim opens or previews a specially crafted spreadsheet, as described in Microsoft's MSRC update guide. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no privileges or credentials are needed, but the required user interaction makes phishing delivery of the malicious file the practical attack path, with any code running at the privilege level of the user who opens it. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, Office for Mac (365/2021/2024), and Office Online Server, so this is a broad default-installation exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published an update so patching is the decisive control.
Remote code execution in Microsoft Excel is possible via a heap-based buffer overflow that an unauthenticated attacker can trigger by convincing a targeted user to open a specially crafted workbook (UI:R), with code running in the context of that user. No public exploit code was identified at time of analysis, and the required user interaction - typically a phishing attachment, web-hosted document, or file-share lure - is the primary limiting factor on practical exploitation. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021, Office LTSC/365 for Mac, and Office Online Server, making this a genuine patch-priority item for environments still on vulnerable builds.
Code execution in Microsoft Excel is possible when an unauthenticated remote attacker convinces a user to open a specially crafted workbook, triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and allow arbitrary code to run in the context of the application. The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and the listed Mac LTSC/365 builds, with exploitation requiring user interaction to open the document (UI:R). Microsoft has released patched versions for the Windows and server builds, and no public exploit identified at time of analysis.
Stack-based buffer overflow in the Excel document parser allows a remote, unauthenticated attacker to execute code in the context of the current user when a victim opens a maliciously crafted spreadsheet. Exploitation requires user interaction (UI:R) - the file must be opened - and the attacker gains no elevated privileges, with code running locally rather than as SYSTEM or root, though impact to confidentiality, integrity and availability is rated high for that user context. The flaw affects Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021/2024, and a vendor patch is available; no public exploit code was identified at time of analysis and exploitation has not been confirmed as active (no CISA KEV listing), so risk is driven by the large Office install base and the ease of delivering a file by email or web rather than by observed attacks.
Memory corruption in Microsoft Excel lets a remote, unauthenticated attacker execute code in the context of the user who opens a specially crafted spreadsheet. The flaw is a use-after-free (CWE-416) triggered while Excel parses the malicious document, and it affects Microsoft 365 Apps for Enterprise, Office LTSC 2024 and 2021 on Windows, and Office/Office LTSC for Mac 2021 and 2024. The decisive limiting factor is the required user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8): there is no zero-click or server-side path, so exploitation depends on social engineering to get a victim to open the file; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied. This makes it a genuine high-priority patch item rather than a drop-everything emergency.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of a victim user by convincing them to open a crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122). CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), confirming no attacker credentials are needed but requiring user interaction (opening the file, typically via phishing or a malicious download); the code executes with the victim's privileges, so a low-privileged account limits the immediate impact. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 and LTSC for Mac, Office 365 for Mac, and Office Online Server below patched versions like 16.0.14334.20974, 16.0.17932.21056, and 16.0.10417.20228, and no public exploit or KEV listing is confirmed at time of analysis.
Out-of-bounds read in Microsoft Excel enables remote code execution (CVSS 8.8) when a user opens or previews a specially crafted workbook, requiring user interaction (UI:R) but no attacker authentication (PR:N). Affected products include Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365/LTSC for Mac, Office Online Server, and SharePoint Server Subscription Edition builds prior to vendor-fixed versions, so server-side document rendering can broaden exposure. No public exploit identified at time of analysis, and vendor patches are available; the primary limiting factor is the required user action.
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted workbook, driven by a heap-based buffer overflow. Affected versions include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Office Online Server before 16.0.10417.20228, Microsoft 365 Apps for Enterprise, and the listed macOS Office builds; the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit was identified at time of analysis and no CISA KEV entry is provided, but the mandatory user interaction makes social engineering the practical attack path, and vendor patches are available.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of the current user when a victim opens or previews a specially crafted spreadsheet, making this a genuine high-priority vulnerability for environments running Microsoft Office/Excel. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows no credentials or pre-existing privileges are needed, but because user interaction is required (UI:R) and no non-default configuration is involved, exploitation depends on social engineering - typically a phishing attachment, a malicious link, or a web-hosted document - rather than direct remote triggering. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available per Microsoft's advisory.
Remote code execution in Microsoft Excel can be triggered by a stack-based buffer overflow when a victim opens a specially crafted workbook, allowing arbitrary code in the context of the opening user. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac variants, and Office Online Server; the attack is network-deliverable (AV:N) and requires no authentication (PR:N) but depends on user interaction (UI:R) to open the file. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Opening an attacker-crafted Excel workbook in affected Microsoft 365 Apps for Enterprise, Office 365 for Mac, or Office LTSC for Mac builds can trigger a heap-based buffer overflow (CWE-122) that lets an unauthenticated remote attacker execute code in the context of the victim user, earning a CVSS 3.1 base score of 8.8 (High). Delivery is network-based and requires no credentials or special configuration, but the attacker must persuade the victim to open the malicious file (UI:R), so a successful email attachment or download plus user action is sufficient to reach the vulnerability. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the mandatory user-interaction step means Protected View, Mark-of-the-Web blocking, and attachment filtering remain meaningful brakes despite the high base score.