Microsoft Excel CVE-2026-40360

Exploitation requires the victim to open an attacker-crafted spreadsheet file in an affected Office/Excel product (UI:R - user interaction is mandatory), and access is local (AV:L), not remote/network-triggered. No authentication or prior privileges on the target are needed (PR:N). Limiting factors: the attacker must deliver the malicious file and induce the user to open it, Microsoft's Protected View sandboxes untrusted files by default (blunting exploitation unless the user clicks 'Enable Editing'), and the payload must match the specific vulnerable parsing path. For Office Online Server, the condition is that the server renders/parses an attacker-supplied spreadsheet. This is an information-disclosure (out-of-bounds read) primitive only - it does not by itself grant code execution.

Signals are consistent and point to a low-to-moderate real-world priority despite the 7.8 'High' CVSS. The CVSS vector (AV:L/AC:L/PR:N/UI:R) requires local access and user interaction - the victim must open a malicious file - which limits mass exploitation. EPSS is 0.06% (18th percentile) and CISA SSVC records Exploitation: none and Automatable: no, all reinforcing that this is not being actively or automatically exploited. There is a notable internal conflict to flag: the description states this only allows an attacker to 'disclose information locally' (an out-of-bounds READ), yet the Microsoft-supplied CVSS vector asserts C:H/I:H/A:H - integrity and availability impact that a pure read primitive does not obviously justify. This likely reflects Microsoft's conservative worst-case scoring rather than confirmed write/crash impact; verify with the vendor before treating this as an integrity/availability issue. Net: a genuine but lower-urgency information-disclosure bug best handled in normal Patch Tuesday cycles rather than emergency response.

An attacker emails a crafted .xlsx/.xls file or hosts it on a web page and social-engineers a target into opening it in Excel. On open, Excel's parser reads out of bounds and the attacker recovers leaked process memory - potentially fragments of other open documents, credentials, or memory-layout data useful for chaining with a separate code-execution bug. No public proof-of-concept has been identified at time of analysis, and exploitation requires the victim to open the file.