Office Online Server CVE-2026-32199

The victim must open a crafted Excel file (.xls, .xlsx, .xlsm, or similar format) sent by the attacker in Microsoft Office Excel. Local access required; no network exploitation possible. Affects Excel 2016-2021 and newer versions on Windows systems.

Real-world risk is moderate-high despite the 7.8 CVSS score. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local attack vector with low complexity, no privileges required, but mandatory user interaction - attacker must convince a user to open a weaponized Excel file. EPSS data not provided, but similar Office memory corruption vulnerabilities typically show moderate exploitation probability given Microsoft Office's ubiquity and attacker familiarity with document-based attack chains. No CISA KEV listing indicates no confirmed active exploitation campaigns at time of analysis. The PR:N designation means attackers need no authentication or existing system access, but local attack vector constrains remote exploitation without combining this with delivery mechanisms (phishing, drive-by downloads). SSVC technical impact is high (arbitrary code execution with full Excel process privileges), automatable is no (requires social engineering), and exploitation status is none (no public POC). This represents a credible threat in targeted attacks against organizations using affected Office versions, particularly via email-borne malicious documents, but lower priority than network-accessible or actively exploited vulnerabilities. Patch availability across all product lines significantly reduces sustained risk for organizations with robust patch management.

An attacker crafts a malicious Excel workbook containing specially formatted data structures that trigger the use-after-free condition during parsing. The attacker distributes this weaponized .xlsx file via spear-phishing email targeting finance or operations personnel who routinely open spreadsheets. When the victim opens the file in a vulnerable Excel version, the memory corruption occurs, allowing the attacker to execute arbitrary code with the privileges of the logged-in user, potentially installing malware, exfiltrating sensitive financial data, or establishing persistent access to the corporate network.