Office Online Server CVE-2026-32188

The victim must open a crafted Excel file (.xls, .xlsx) on a local Windows system running Microsoft Office Excel. Requires user interaction to open the malicious file. No authentication required. Affects Microsoft Office Excel versions where this vulnerability is unpatched.

The CVSS 7.1 score reflects genuine risk but with important constraints limiting real-world exploitation urgency. The attack vector (AV:L) requires local file system access, and user interaction (UI:R) mandates convincing targets to open weaponized Excel files, establishing significant exploitation barriers. Attack complexity remains low (AC:L), meaning successful exploitation is straightforward once file delivery occurs. The vulnerability enables high confidentiality impact (C:H) through memory disclosure of potentially sensitive data like encryption keys, credentials, or adjacent document content, plus high availability impact (A:H) suggesting crash potential. Critically, the vulnerability is unauthenticated (PR:N) within local context, requiring no privileges beyond file execution rights. No EPSS score provided but the local-only attack vector and lack of confirmed active exploitation (no KEV status) reduce immediate severity. No public exploit identified at time of analysis, though the straightforward nature (AC:L) suggests exploit development feasibility. SSVC decision factors: exploitation status is none, technical impact is significant (information disclosure plus DoS), but automatable exploitation is constrained by mandatory user interaction. Priority should focus on email-exposed users and high-value targets handling sensitive spreadsheets, rather than universal emergency patching.

An attacker crafts a malicious Excel spreadsheet containing specially formatted cell data or embedded objects designed to trigger out-of-bounds memory reads during parsing. The attacker delivers this file via phishing email, shared network drives, or compromised file-sharing platforms. When a victim opens the weaponized spreadsheet in any affected Excel version, the parser attempts to process the malformed data structures, reading beyond allocated buffer boundaries. This exposes adjacent memory contents potentially containing fragments of other documents, cached credentials, cryptographic material, or process memory, which the attacker could extract through observable application behavior or side-channel analysis. Simultaneously, the memory access violation may crash the Excel process, causing denial of service and potential data loss from unsaved work.