Maxkb CVE-2026-39424

CVSS 5.3 (AV:N AC:L PR:L UI:N) indicates network attack vector, low complexity, low privilege requirement, and no user interaction-favorable conditions for an attacker. However, the actual real-world risk is constrained by several factors. First, exploitation requires an authenticated administrator (PR:L), limiting the attacker pool to insiders or users who have compromised admin credentials. Second, the impact scope is limited to the administrator's local workstation (VC:L VI:L VA:L with no scope escalation), not the server itself, reducing blast radius. Third, while DDE is a known technique, it requires the victim to open the malicious .xlsx file in Microsoft Excel specifically (or compatible applications), introducing a UI/social engineering component not captured in the CVSS score. The EPSS score (not provided) would likely reflect this-moderate to moderate-low real-world exploitation probability. SSVC assessment: exploitation is unconfirmed (no KEV, no public POC), technical impact is contained (local code execution only), but automatable (direct API call, deterministic payload). Remediation is straightforward (upgrade to 2.8.0), and the attack surface is admin-only, making this a medium-priority vulnerability for most organizations but critical for those with strict insider-threat or supply-chain security models.

An authenticated administrator with legitimate export permissions uses the chat export API to download chat history containing a malicious payload crafted by an attacker who has injected a formula string into the chat (e.g., a user-submitted message containing '=cmd|'/c calc'!A1'). The administrator receives a benign-looking Excel file and opens it in Microsoft Excel. Upon opening, Excel automatically interprets the formula and executes the embedded command (calc.exe, or a more sophisticated payload like a reverse shell), granting the attacker code execution in the administrator's security context. No user interaction beyond opening the file is required due to DDE's automatic execution.