Microsoft Excel CVE-2026-108446

Exploitation requires a user to open or preview a specially crafted Excel spreadsheet in an affected Office/Excel build (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac 2021/2024, Office 365 for Mac, or Office Online Server); the use-after-free is triggered during file parsing. The limiting factor is mandatory user interaction (UI:R in the vector) - there is no server-side or preview-pane-only auto-trigger stated - so the attacker depends on social engineering to get the file opened. No authentication is required of the attacker (PR:N), and default configurations are affected, but Protected View / Mark-of-the-Web warnings and user caution materially reduce real-world exploitability.

This is a genuine high-priority vulnerability, though not a drop-everything emergency on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw (CWE-416 use-after-free) that yields full confidentiality, integrity, and availability impact - i.e., arbitrary code execution. The single mitigating factor in the vector is UI:R: a user must open or preview a crafted Excel document, which is why this is not a 9.8/wormable issue. No EPSS score, KEV listing, or public POC was supplied in the input, so on the exploitation-likelihood axis the picture is currently quiet: no evidence of active exploitation and no public exploit identified. The tension to flag explicitly is that Office file-format RCEs of this class are historically high-value for phishing-driven intrusion and frequently weaponized after patch disclosure, so the low current exploitation signal should be read as 'not yet' rather than 'low risk.' A vendor patch is available, which both confirms the flaw's legitimacy and raises the odds of eventual reverse-engineering into an exploit. Net: patch promptly given the ubiquity of Office and the full-impact RCE, while noting that known-exploitation signals are absent at analysis time.

An attacker emails a victim a malicious .xlsx/.xls spreadsheet (or hosts it on a web/file share) and lures them into opening it in Excel, where parsing triggers a use-after-free and executes attacker-controlled code in the user's context. Because the CVSS vector requires user interaction (UI:R), the attack hinges on social engineering rather than an unassisted remote trigger. No public exploit code was identified in the provided data.