Office Online Server CVE-2026-32189

The victim must open a crafted Excel file (.xls, .xlsx, or similar) sent by the attacker in Microsoft Office Excel. Local attacker with no privileges required; user interaction (opening the file) is mandatory.

This represents a moderate-to-high real-world risk requiring prioritized but not emergency patching. The CVSS 7.8 score accurately reflects severe technical impact (full confidentiality/integrity/availability compromise) balanced against practical exploitation constraints. Attack complexity is low (AC:L) and requires no privileges (PR:N), but the local attack vector (AV:L) and mandatory user interaction (UI:R) significantly constrain mass exploitation scenarios. Attackers must successfully deliver malicious Excel files and convince targets to open them, making this a targeted attack vector rather than wormable infrastructure threat. No public exploit code exists and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation campaigns. The SSVC decision framework suggests delayed patching acceptable for most organizations: exploitation requires social engineering (not automatable), technical impact is total system compromise (high), but delivery mechanism is constrained. Prioritize patching for high-value targets in finance, legal, healthcare, or government sectors where Excel document exchange is routine and adversaries have strong motivation for targeted intrusion.

An attacker crafts a malicious Excel spreadsheet containing embedded objects or formulas designed to trigger the use-after-free condition during document parsing. The attacker distributes this file via spear-phishing email targeting finance personnel, embedding convincing social engineering (invoice review, budget spreadsheet, financial report) to encourage opening. When the victim opens the file in vulnerable Excel versions, the parsing engine frees memory prematurely while retaining references, allowing the attacker's payload to manipulate the freed memory region and redirect execution flow to shellcode embedded in the document, achieving arbitrary code execution with the victim's privileges.