Microsoft Excel CVE-2026-47642

Exploitation requires the victim to open a specially crafted Excel document in an affected Office build (AV:L/AC:L/PR:N/UI:R), so the mandatory prerequisite is user interaction - opening or previewing the malicious spreadsheet - with no authentication or prior privileges on the target needed. What limits exploitation: the required user interaction (a file must be delivered and opened), the mitigating effect of Protected View/Mark-of-the-Web sandboxing on internet-sourced files, and the need for the target to run one of the specifically affected products (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, the Mac 2021/2024 editions, or Office Online Server). Code executes in the security context of the user who opens the file, not automatically as SYSTEM.

CVSS is 7.8 (High) with a local attack vector (AV:L) that in Microsoft's model means the malicious content executes on the local machine after the user opens the file, combined with low complexity (AC:L), no privileges (PR:N), and required user interaction (UI:R). No EPSS score was provided in the input, and there is no KEV listing and no POC signal, so exploitation probability cannot be quantified from the data given - treat the UI:R requirement as the primary limiting factor that keeps real-world risk below that of a zero-click network bug. The high triple-impact (C:H/I:H/A:H) and the broad, ubiquitous product footprint make this a meaningful patch priority for endpoint fleets even though it is not automatable at scale and depends on social engineering. Note one nuance to verify: the tags include 'Denial Of Service' alongside 'Memory Corruption', which is broader than the description's 'execute code' claim - the code-execution characterization drives the assessment here, but defenders should confirm the precise impact against Microsoft's advisory.

An attacker emails a target a crafted Excel spreadsheet (e.g., disguised as an invoice or report); when the victim opens it in a vulnerable Office build, the use-after-free is triggered during parsing and attacker-controlled code runs in the context of the user. No public POC or active exploitation is identified at time of analysis, and the low attack complexity means a working exploit would reliably fire once the file is opened, but success hinges entirely on convincing the user to open the document.