EUVD-2026-29641
GHSA-whc2-9r39-wqcm
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open client exploitation gives AV:L and UI:R with no privileges (PR:N); a successful use-after-free yields full code execution, so C/I/A are all High.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Excel (Excel 2016, Office 2019/LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) arises from a use-after-free memory corruption flaw that an attacker triggers by convincing a user to open a specially crafted spreadsheet. Successful exploitation yields full compromise of the current user's context (high confidentiality, integrity, and availability impact). There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records exploitation status as none, indicating this is a patch-in-cycle issue rather than an active threat.
Technical ContextAI
The root cause is CWE-416 (Use After Free), a memory-corruption class in which code continues to reference a heap object after it has been freed, allowing an attacker who controls the reallocated memory to hijack a dangling pointer and steer execution. In Excel this is reached through the file-parsing/rendering engine when processing a malicious workbook, so the vulnerable component is the Office desktop and server code shared across the affected SKUs. Per the CPE data, this spans the Windows Office family (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024), the macOS builds (Office LTSC for Mac 2021/2024), and the server-side Office Online Server, meaning both interactive desktop use and server-side document rendering are in scope.
RemediationAI
Apply the Microsoft-released update for your Office channel as the primary fix: Vendor-released patch - Excel 2016 to 16.0.5552.1000 or later, Office for Mac (LTSC 2021/2024) to 16.109.26051019 or later, and Office Online Server to 16.0.10417.20128 or later; for Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024 install the current security build via https://aka.ms/OfficeSecurityReleases, with details in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40359. Because exploitation requires a user to open a malicious file, effective compensating controls until patching completes are: enforce Protected View / Office block-macros-and-untrusted-files-from-the-internet policies so untrusted workbooks open sandboxed (trade-off: users must click to exit Protected View, mild friction), block or quarantine spreadsheet attachments (.xls/.xlsx/.xlsm) at the mail gateway from external senders (trade-off: may delay legitimate business documents), and for Office Online Server restrict document-rendering access to trusted internal sources only (trade-off: reduces external collaboration functionality).
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today