EUVD-2026-100320
GHSA-xj5f-rvvj-2rmf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Excel file to victim
-
DeliveryVictim opens file in Excel
-
ExploitTrigger use-after-free in parser
-
ExecutionExecute arbitrary code as user
-
ImpactInstall payload / escalate
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open or preview an attacker-crafted Excel document in Microsoft Office Excel (UI:R in the CVSS vector), making this a client-side, user-interaction-dependent attack rather than a zero-click remote one. No authentication or elevated privileges are needed on the target (PR:N), and no special non-default Excel configuration is indicated by the description. The principal limiting factors are the mandatory social-engineering step to get the victim to open the file and the fact that code executes only in the context/privilege level of the opening user (S:U). Protected View / Mark-of-the-Web sandboxing on files from untrusted sources further constrains realistic exploitation. |
| Impact | CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-deliverable, low-complexity flaw requiring no privileges but requiring user interaction (UI:R) - consistent with a malicious Excel document that must be opened by a victim. This is a CWE-416 use-after-free in Microsoft Office Excel, a memory-corruption class that is frequently weaponizable into full code execution. However, several exploitation-pressure signals are MISSING from the input: no EPSS score is provided, there is no CISA KEV listing, and no public POC is referenced - so despite the high CVSS, there is no evidence of active exploitation at time of analysis. The AV:N rating reflects Microsoft's convention of treating file-delivery-over-network as network vector, but real-world exploitation still hinges on social engineering to get a user to open a crafted file, which materially lowers the practical risk versus a true zero-click remote vector. Net: a genuinely serious client-side RCE in an extremely widespread product that warrants prompt patching, but currently a patch-priority driven by severity and product footprint rather than by confirmed in-the-wild exploitation. |
| Exploit ScenarioDerived | An attacker emails a victim a crafted .xlsx/.xls file (or hosts it on a website/share) and lures them into opening it in Microsoft Excel. Parsing the malformed content triggers a use-after-free, which the attacker leverages to execute arbitrary code in the context of the user. No public exploit code is identified at time of analysis, so weaponization effort would currently fall on the attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Use-after-free memory corruption in Microsoft Office Excel allows remote, unauthenticated attackers to execute arbitrary code in the context of the user who opens a crafted spreadsheet (CVSS 3.1 base 8.8, High; AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is client-side and hinges on user interaction: the victim must open or preview an attacker-supplied Excel document, so delivery depends on a social-engineering lure (email attachment, hosted file, or file-share link) and resulting code runs only at the privilege level of the opening user. No public exploit code and no confirmed active exploitation (CISA KEV) were identified in the available intelligence at time of analysis, and Protected View plus Mark-of-the-Web handling of files from untrusted sources materially constrains realistic exploitation.
RemediationAI
Primary remediation is to apply Microsoft's fix for CVE-2026-100209 as published in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100209); no specific patched build number is present in the available data, so administrators should pull the exact version from that advisory and deploy through their normal update channel (Microsoft Update, Microsoft 365 Apps update channel, or the applicable Office servicing baseline), prioritizing users who routinely open externally sourced spreadsheets. Until patched, effective compensating controls center on preventing malicious documents from reaching the vulnerable parsing path: ensure Protected View is enabled for files originating from the internet, email attachments, and other untrusted locations, and do not allow users to disable it; enforce Mark-of-the-Web so downloaded files retain untrusted-zone status; block or strip dangerous attachment types at the email gateway and web proxy rather than relying on user judgment; and consider Microsoft Defender Application Guard for Office or an equivalent sandbox so that a successful exploit is contained. Note the trade-offs: Protected View and Application Guard add friction and can slow legitimate workflows with external files, and attachment blocking may disrupt business file exchange, so pair these with a user reporting process for blocked content. Attack surface reduction rules that block Office child processes and macro execution from downloaded files reduce post-exploitation activity but do not by themselves stop the underlying use-after-free, so they are supplementary rather than a substitute for patching. There is no vendor-released patch version confirmed in the supplied data and no public exploit code identified, so monitoring the MSRC advisory for updated guidance and watching for unusual Excel child-process spawning remains prudent.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Microsoft Office Excel's handling of document content. In this memory-safety class, the application frees a heap object - typically a structure allocated while parsing workbook data, records, or embedded objects - but retains and later dereferences a stale pointer to that freed region. An attacker who can control the layout of workbook content can influence the contents of the freed memory (for example, by reallocating it with attacker-controlled data), causing the stale pointer to write into or call through memory the attacker influences, which can redirect control flow and result in arbitrary code execution. The CVSS vector describes network delivery (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and no scope change (S:U), while UI:R reflects that the malicious document must be opened or previewed by a user; the impact ratings of C:H/I:H/A:H indicate full loss of confidentiality, integrity, and availability within the victim's Excel process. Because execution occurs in the user's security context, impact severity scales with that user's privileges (and is reduced when Protected View, Application Guard, or Mark-of-the-Web blocking is enforced). No CPE strings were supplied with this record, so the exact affected Excel/Office build numbers must be confirmed against the vendor advisory rather than inferred here.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File delivered over network with UI:R since the victim must open a crafted document; PR:N as no auth is needed, and a UAF RCE yields high C/I/A in the user's context (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A memory-corruption flaw in Microsoft Excel (CVE-2026-100209) could allow an attacker to execute code on a workstation whenever a user opens a specially crafted spreadsheet, giving them the same access and data rights as that employee. No vendor patch is currently available, so exposure is governed by how well existing email, download, and Protected View controls stop malicious documents from being opened. Leadership should care because Excel is used by nearly every role in the organization and the attack depends only on a convincing lure, not on any foothold inside the network.
No vendor-released patch identified at time of analysis; there is no public exploit identified at time of analysis. The vulnerability is unauthenticated from the attacker's perspective but requires the victim to open the crafted file, so interim mitigations center on preventing that action from succeeding: enforce Protected View and Mark-of-the-Web handling for documents from untrusted sources, block macros and legacy Excel formats arriving via email or download, disable or restrict Office preview handlers, apply Microsoft Defender for Endpoint attack surface reduction rules against Office child-process creation and code injection, and reinforce user reporting of suspicious spreadsheet attachments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB