Microsoft Excel CVE-2026-40359

Exploitation requires the victim to open an attacker-supplied, specially crafted Excel spreadsheet in an affected Office build (UI:R in the CVSS vector) - there is no remote or network-triggerable path and no automatic exploitation. No authentication or pre-existing privileges are needed on the target (PR:N), and code runs at the privilege level of the user who opens the file. Limiting factors that reduce realistic risk: the mandatory user interaction, the fact that Office Protected View / Mark-of-the-Web sandboxing intercepts files downloaded from the internet or email before the vulnerable parsing path executes, and the local-only attack vector meaning the attacker must first deliver the file to the user.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: exploitation is local and requires user interaction (opening a file) but no prior privileges, and grants total impact to all three security properties. These signals are mutually consistent and corroborated by SSVC, which rates Technical Impact as total but Exploitation as none and Automatable as no - meaning the damage is severe if triggered, but it cannot be worm-like automated because it hinges on luring a user to open a file. The very low EPSS (0.06%, 18th percentile) and absence of KEV/POC reinforce that real-world exploitation risk today is low despite the high severity; the tag 'Denial Of Service' appears alongside 'Use After Free' but the CVSS A:H already captures availability impact, and the description explicitly states code execution, so DoS is a secondary, not primary, outcome. Overall this is a standard Patch-Tuesday-class client-side memory-corruption bug: prioritize via normal patch cycles rather than emergency response.

An attacker crafts a malicious Excel workbook that triggers the use-after-free and emails it as a business document (e.g., an invoice or report) to a target. When the victim opens the file in a vulnerable Excel build and exits Protected View, the dangling pointer is exploited to run arbitrary code in the user's security context. No public proof-of-concept has been identified at time of analysis, and the AV:L/UI:R vector means each compromise depends on a separate successful social-engineering lure.