What is the CVSS score of CVE-2026-44817?

CVE-2026-44817 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Excel are affected by CVE-2026-44817?

Microsoft Office Excel contains a memory corruption vulnerability (CVE-2026-44817) allowing attackers to execute arbitrary code on users' machines through malicious spreadsheets, potentially…. A patch is available.

How to fix or mitigate CVE-2026-44817?

Within 24 hours: Conduct inventory of Excel usage patterns; communicate vulnerability advisory to all users emphasizing file source validation and suspicious file reporting. Within 7 days: Enable Office Protected View for all external Excel files; disable or require administrative approval for macro execution; restrict file sources to trusted internal channels only. Within 30 days: Monitor Microsoft security advisories for patch release; establish patching timeline and deployment plan immediately upon vendor fix availability.

Microsoft Excel CVE-2026-44817

EUVD-2026-35660 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-09 secure@microsoft.com

GHSA-2p34-ppjg-jr32

Microsoft Authentication Bypass Memory Corruption 365 Apps Excel Microsoft 365 Office 2019 Office 2021 Office 2024 Office Online Server

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:31 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office Excel arises from an integer underflow condition that corrupts memory when a malicious spreadsheet is opened. The flaw requires user interaction (UI:R) to trigger but needs no prior authentication, enabling attackers to run arbitrary code in the security context of the victim user. At the time of analysis, no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The underlying weakness is classified under CWE-843 (Access of Resource Using Incompatible Type - Type Confusion), though the description specifically names an integer underflow (wrap or wraparound), where an arithmetic operation produces a value below the representable minimum and wraps to a large unsigned value. In Office file parsers, such wraparounds typically occur when length, offset, or count fields from a crafted .xls/.xlsx structure are decremented or subtracted without bounds validation, causing the parser to mis-size buffers or index out of bounds. The combination with type confusion behavior suggests the underflowed value drives an object/structure interpretation, leading to memory corruption inside the Excel process. The affected technology is Microsoft Office Excel on the Windows desktop client; exact CPE strings are not provided in the supplied data.

RemediationAI

Apply the patch available per vendor advisory by installing the corresponding Microsoft Patch Tuesday update for Excel referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44817 across all affected Office channels (Microsoft 365 Apps Current/Monthly Enterprise, Semi-Annual, and standalone Office 2019/2021/2024 builds); exact fix build numbers are listed in that MSRC entry and should be taken from there directly rather than inferred. Until patching is complete, enable Protected View for files originating from the Internet and Outlook attachments (File > Options > Trust Center > Protected View) so Excel opens untrusted workbooks in a sandboxed read-only mode - the trade-off is that users must explicitly click 'Enable Editing' for legitimate external files, generating helpdesk friction. Additionally, block inbound Excel attachments (.xls, .xlsm, .xlsb, .xlsx) at the mail gateway for high-risk user groups and consider enforcing Attack Surface Reduction rule 'Block Office applications from creating child processes' (GUID d4f940ab-401b-4efc-aadc-ad5f3c50688a) to limit post-exploitation; the side effect is that legitimate macros or add-ins that spawn helper processes will break.