Office Online Server CVE-2026-32198

User interaction required: victim must open a malicious Excel file (.xls, .xlsx, or similar format) on a local system where Microsoft Office Excel is installed. No special administrative privileges needed.

Real-world exploitation risk is moderate despite the High CVSS 7.8 rating. The local attack vector (AV:L) with required user interaction (UI:R) creates a meaningful barrier-attackers must deliver malicious Excel files through phishing, drive-by downloads, or compromised file shares, then convince targets to open them. Low attack complexity (AC:L) indicates reliable exploitation once the file is opened, and no required privileges (PR:N) means any user can be targeted without needing prior system access. The complete CIA triad impact (C:H/I:H/A:H) confirms full system compromise potential at the Excel process privilege level. However, no KEV listing indicates CISA has not observed active exploitation in federal networks, and absence of public POC code suggests exploitation remains theoretical or limited to private research. The SSVC decision framework would likely classify this as 'Attend' priority rather than 'Act Immediate' given the lack of confirmed exploitation, the user interaction hurdle, and available patches. Organizations with robust email filtering, user security awareness training, and Protected View configurations face lower practical risk than the CVSS score alone suggests. Patch prioritization should focus on high-value targets and externally accessible Office Online Server deployments where attack surface is elevated.

An attacker crafts a malicious Excel workbook containing specially formatted elements that trigger the use-after-free condition during file parsing. The weaponized spreadsheet is delivered via spear-phishing email to finance department employees who routinely handle Excel files. When the victim opens the document, Excel's parsing engine frees a memory object but continues processing references to that memory region. The attacker's payload manipulates the freed memory to redirect code execution, launching arbitrary commands with the user's privileges to install backdoor access, exfiltrate sensitive financial data, or establish persistence for lateral movement across the corporate network.