EUVD-2026-44153
GHSA-gm89-fgch-cv7q
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious file opened locally (AV:L) with required user interaction (UI:R), no prior privileges (PR:N), and memory corruption yielding full code execution gives C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Excel (across Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, and their macOS equivalents) arises from a use-after-free (CWE-416) memory-corruption flaw triggered when a user opens a maliciously crafted spreadsheet. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can achieve full confidentiality, integrity, and availability impact but requires the victim to open a file, making it a classic phishing-delivered client-side bug. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Excel memory-corruption bugs are historically attractive targets.
Technical ContextAI
The root cause is CWE-416 (Use After Free), a memory-safety defect in which the application continues to reference a heap object after it has been freed; a crafted Excel document manipulates object lifetimes so that a dangling pointer is reused, letting an attacker control freed-then-reallocated memory to hijack execution flow. The affected component is Excel's file-parsing/rendering engine shared across the Office suite, as confirmed by the CPE set spanning Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Office LTSC 2021 and 2024, Office 365/LTSC for Mac 2021 and 2024, and Office Online Server. Because the same code runs both on Windows desktop builds and macOS builds, and within Office Online Server, the vulnerable parsing logic is platform-spanning rather than OS-specific.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47642 for each affected channel - Microsoft 365 Apps via Click-to-Run/monthly update, Office 2019 and LTSC 2021/2024 via Windows Update or the corresponding MSI/C2R build, the Mac editions via Microsoft AutoUpdate, and Office Online Server via its server update package; the input does not include an exact patched build number, so confirm the fixed version directly from the MSRC entry before deployment. As compensating controls until patching completes, enforce Protected View and block macros/external content for files originating from the internet, and consider using Group Policy 'Block opening of files from untrusted locations' - the trade-off is user friction when legitimately sharing spreadsheets. Because exploitation requires the victim to open a crafted file, reinforce email attachment filtering and user awareness for unsolicited .xls/.xlsx attachments as an additional layer.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today