What is the CVSS score of CVE-2026-42832?

CVE-2026-42832 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Microsoft Office are affected by CVE-2026-42832?

Microsoft Office on Mac (LTSC 2021/2024) and Excel/Word for Android contain a spoofing vulnerability (CVE-2026-42832) that allows local attackers to bypass access controls and misrepresent document…. A patch is available.

How to fix or mitigate CVE-2026-42832?

Within 24 hours, inventory Microsoft Office LTSC 2021/2024 installations on macOS and Excel/Word deployments on Android devices across your organization. Within 7 days, obtain and test the vendor-released patch in a non-production environment to validate compatibility with dependent applications and workflows. Within 30 days, deploy patches to all affected Office instances on macOS and Android devices in accordance with your standard change management procedures.

Microsoft Office CVE-2026-42832

EUVD-2026-29712 HIGH

Improper Access Control (CWE-284)

2026-05-12 microsoft

GHSA-857p-384w-97mc

Microsoft Authentication Bypass Microsoft Excel For Android Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Microsoft Word For Android

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.7 HIGH

AV:L because the source vector is local-only; PR:N/UI:N as no auth or interaction is indicated; C:H/I:H with A:N matching a spoofing/access-control impact having no availability effect.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:03 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

HIGH 7.7

DescriptionCVE.org

Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.

AnalysisAI

Spoofing in Microsoft Office (Office LTSC for Mac 2021/2024 and Excel/Word for Android) lets an attacker with local access bypass access-control checks (CWE-284) to misrepresent content or its origin to a user. Microsoft has issued a patch; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 13th percentile), so this is a low-likelihood but high-technical-impact issue.

Technical ContextAI

The flaw is an improper access control weakness (CWE-284) in the Office application layer rather than in a network protocol. Per the CPE data, the affected code lives in the Office document-handling engines shipped in Excel for Android, Word for Android, and the macOS Office LTSC 2021/2024 builds - the cross-platform Office codebase, not the Windows click-to-run channel. CWE-284 means the software fails to properly restrict an actor from a resource or action; here that gap is exercised locally and manifests as spoofing, allowing content or provenance to be presented as trustworthy when it is not.

RemediationAI

Vendor-released patch: update Office LTSC for Mac 2021 and 2024 to build 16.109.26051019 or later, and update Excel for Android and Word for Android to 16.0.19822.20190 or later, per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42832. On macOS this ships through Microsoft AutoUpdate and on Android through the Google Play Store, so ensuring automatic updates are enabled resolves it fleet-wide. Because exploitation requires local access, an interim compensating control is to restrict opening of untrusted documents and to limit local and shared-device access to affected installs until the update propagates; this narrows exposure but does not close the underlying access-control gap. Additional advisory context: https://vuldb.com/vuln/363230 and https://nvd.nist.gov/vuln/detail/CVE-2026-42832.