EUVD-2026-100319
GHSA-rcwh-4x4r-ph63
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Excel workbook to victim
-
DeliveryVictim opens malicious file
-
ExploitTrigger use-after-free in Excel parser
-
ExecutionCorrupt memory and hijack execution
-
ImpactRun arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open (or preview) an attacker-crafted Microsoft Excel workbook - this is the UI:R requirement and the primary limiting factor, meaning the flaw is not self-propagating and depends on social engineering or file delivery. No authentication is required (PR:N) and no special non-default Excel configuration is indicated by the description; the use-after-free (CWE-416) is reached through normal file parsing. The practical limiter is therefore user interaction plus whatever Protected View / Mark-of-the-Web / macro-independent mitigations the environment enforces, since the bug is in file processing rather than macros. |
| Impact | This is a credible high-priority vulnerability but not an automatic emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-delivered, unauthenticated (PR:N), low-complexity use-after-free yielding full confidentiality, integrity, and availability impact - i.e. arbitrary code execution. The single meaningful mitigating factor in the vector is UI:R: a user must open or preview a malicious workbook, which is why this is NOT scored as a wormable AV:N/UI:N flaw. No EPSS score was provided, so exploitation probability cannot be quantified; it is NOT in CISA KEV and NO public proof-of-concept is referenced, so there is no evidence of active exploitation or available exploit code at this time. No SSVC decision data was supplied. The signals are therefore internally consistent (network RCE requiring user interaction) rather than conflicting, but the key open questions are missing - without EPSS/KEV/POC this should be treated as a high-severity, patch-promptly issue driven by the enormous install base and historical attractiveness of Office memory-corruption bugs, rather than as a confirmed in-the-wild threat. |
| Exploit ScenarioDerived | An attacker emails a specially crafted Excel workbook or hosts it on a web/file share and lures a victim into opening it. When the file is parsed, the use-after-free in Excel is triggered, corrupting memory and allowing the attacker to execute arbitrary code in the context of the user. No public exploit code is currently identified, and successful exploitation hinges on the victim opening the file (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Code execution in Microsoft Excel can be triggered when a victim opens or previews an attacker-crafted workbook, exploiting a use-after-free (CWE-416) in file parsing. The flaw is remotely reachable with low complexity and no privileges per CVSS (PR:N), but requires user interaction (UI:R), so exploitation depends on file delivery and social engineering rather than self-propagation. No public exploit was identified at time of analysis and no CISA KEV confirmation was provided; the risk is high-priority but not an automatic emergency given the user-interaction requirement.
RemediationAI
The provided data does not include an exact fix version; apply the latest Microsoft Office/Excel security update after validating against the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100211, and treat patch availability as requiring confirmation from that source. Until patching is verified, prioritize user-interaction mitigations: enforce Microsoft Protected View for files from the internet, email attachments, and untrusted locations, and keep Mark-of-the-Web intact, accepting added user friction for expected prompts. Consider blocking or quarantining untrusted Excel attachments at email and web gateways, and disable Explorer/Outlook preview handlers for Office files if the business can tolerate reduced preview convenience. Where feasible, use Defender Exploit Guard or application control to harden Excel, noting possible compatibility issues with add-ins or legacy macros. These are compensating controls, not substitutes for vendor patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Microsoft Office Excel processes complex workbook structures such as OLE compound documents and BIFF/OOXML data into in-memory objects. CWE-416 indicates a use-after-free: a heap object is freed during parsing or rendering, but a dangling pointer is later dereferenced, allowing an attacker who controls the file layout to influence memory contents and potentially achieve arbitrary code execution in the Excel process. The assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms network delivery with low attack complexity, no authentication, and high impact to confidentiality, integrity, and availability, but also confirms the user must open or preview the malicious workbook. The advisory tags also include memory corruption and denial of service, consistent with a memory-safety bug in Excel's file parsing path rather than a macro execution issue.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File delivered over a network with no authentication gives AV:N/PR:N, but opening the crafted workbook is mandatory (UI:R); the use-after-free yields full code execution in the user context, so C/I/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Excel contains a high-severity remote code execution vulnerability (CVE-2026-100211) that can be triggered when a user opens or previews a malicious workbook. With no vendor patch currently available, any organization relying on Excel for daily operations is at risk, and successful exploitation could lead to unauthorized code execution on user endpoints, potentially compromising sensitive data or enabling further network intrusion. Leadership should prioritize immediate mitigating controls and user awareness while awaiting a patch.
No vendor-released patch identified at time of analysis. Apply interim mitigations: block or quarantine Excel attachments from external sources, disable Excel preview in email clients and file explorers, enforce Protected View, disable macros by default, implement application whitelisting, conduct user awareness training, and monitor for anomalous Excel process behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB