EUVD-2026-29644
GHSA-qxwr-vc23-g88h
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open exploitation gives AV:L and UI:R with no prior privileges (PR:N); reliable heap overflow yields low complexity and total CIA impact within the user's context (S:U).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Arbitrary code execution in Microsoft Excel (and the broader Office family through Microsoft 365 Apps, Office 2019, LTSC 2021/2024, Office for Mac, and Office Online Server) is possible when a user opens a maliciously crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122), running attacker code in the context of the current user. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.06%, 18th percentile), but the technical impact is total (full confidentiality, integrity, and availability loss). Microsoft has released patches; exploitation requires the victim to open a file, so it is a phishing/social-engineering-driven local vulnerability rather than a remotely wormable one.
Technical ContextAI
The flaw is a CWE-122 heap-based buffer overflow in the file-parsing code of Microsoft's Office/Excel document engine. Excel processes complex binary and OOXML spreadsheet structures, and a malformed record can cause the parser to write past the bounds of a heap-allocated buffer, corrupting adjacent heap metadata or object pointers and enabling control-flow hijack. The CPE set confirms the shared code affects multiple delivery channels of the same Office engine: microsoft_365_apps_for_enterprise, microsoft_excel_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024, and office_online_server - meaning both Windows and macOS builds, and the server-side Office Online Server rendering component, are in scope.
RemediationAI
Apply Microsoft's security update per the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40362): update Excel 2016 to 16.0.5552.1000, Office for Mac 2021/2024 to 16.109.26051019, and Office Online Server to 16.0.10417.20128; for Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024 install the latest channel update via https://aka.ms/OfficeSecurityReleases. Because exploitation requires opening a crafted file, effective compensating controls until patching completes include enforcing Protected View and blocking files originating from the internet/email (Mark-of-the-Web), enabling Office macro and Trust Center restrictions, and using attack-surface-reduction rules to limit Office child-process creation - trade-off is some friction for users who legitimately edit externally sourced spreadsheets. For Office Online Server, restrict and patch the rendering host promptly since server-side parsing of untrusted documents removes the per-user interaction barrier. Do not rely on email filtering alone.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today