Office Online Server CVE-2026-32197

User must open a malicious Excel file (.xlsx, .xls, or similar) on a local Windows system. No authentication required. Attacker relies on social engineering or file delivery to trigger user interaction with the crafted spreadsheet containing the use-after-free payload.

Real-world risk is moderate despite the high CVSS 7.8 score. The attack vector is local (AV:L) with low complexity (AC:L) but critically requires user interaction (UI:R) - victims must open a malicious Excel file, limiting automated exploitation. No privileges are required (PR:N), but the local delivery constraint means attackers need social engineering or watering-hole tactics rather than direct remote exploitation. No public exploit code exists and CISA KEV does not list this vulnerability, indicating no confirmed active exploitation campaigns at time of analysis. The SSVC decision framework would classify this as 'scheduled remediation' rather than 'immediate action' for most organizations: exploitation is not automatable (requires user interaction), technical impact is high (arbitrary code execution), but exploitation status remains proof-of-concept at most. Organizations handling sensitive financial data or operating in high-threat environments should prioritize patching given the attacker-controlled code execution outcome, while general enterprise environments can address this through routine patch cycles with user awareness training as interim mitigation.

An attacker crafts a malicious Excel spreadsheet containing specially formatted cell data or embedded objects designed to trigger the use-after-free condition during file parsing. The attacker distributes this file via phishing email, cloud storage links, or compromised websites targeting employees in finance, HR, or data analysis roles. When a victim opens the weaponized spreadsheet in Excel, the application attempts to render the malicious content, triggering premature memory deallocation while still referencing the freed objects. The attacker's payload overwrites the freed memory region, hijacking control flow and executing arbitrary shellcode with the victim's user privileges, enabling credential theft, ransomware deployment, or lateral movement within the network.