What is the CVSS score of CVE-2026-26134?

CVE-2026-26134 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-26134?

A local privilege escalation vulnerability in Microsoft Office could allow authorized users to gain elevated system access, potentially compromising sensitive data and critical business systems.. A patch is available.

How to fix or mitigate CVE-2026-26134?

Within 24 hours: Inventory all Microsoft Office deployments and identify users with administrative or sensitive data access. Within 7 days: Implement application whitelisting and restrict Office macro execution to trusted sources; disable unnecessary Office features (DDE, ActiveX) via Group Policy. Within 30 days: Monitor for exploitation attempts; establish a vendor patch monitoring protocol to deploy immediately upon availability; consider evaluating alternative office productivity solutions for high-risk users.

Microsoft CVE-2026-26134

HIGH

Integer Overflow or Wraparound (CWE-190)

2026-03-10 secure@microsoft.com

Microsoft Integer Overflow Buffer Overflow

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 7.8

DescriptionCVE.org

Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.

AnalysisAI

Microsoft Office is vulnerable to an integer overflow that allows authenticated local users to escalate their privileges and gain full system control. An attacker with valid credentials can exploit this numeric calculation flaw to execute arbitrary code with elevated permissions. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-190 (Integer Overflow or Wraparound). Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.