Microsoft Excel CVE-2026-48580

Exploitation requires the victim to actively open a specially crafted Excel file on a locally running, unpatched instance of an affected product - the CVSS AV:L/UI:R metrics confirm both the local-only attack surface and the mandatory user-interaction gate. The attacker has no network-reachable exploitation path; the malicious file must be delivered out-of-band (email, shared storage, download) and the user must choose to open it. No special Excel configuration, feature enablement, or macro execution is required beyond the file-open action itself. Exploitation is further constrained by SSVC's 'not automatable' determination, ruling out worm-style or mass-exploitation campaigns. Limiting factors for defenders: the local vector eliminates internet-exposed attack surface, Protected View (if enabled for internet-origin files) blocks parsing before the vulnerable code path is reached, and only unpatched build versions within the Excel 2016 through LTSC 2024 family are susceptible.

CVSS 5.5 Medium with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N accurately characterizes a constrained threat: exploitation is strictly local, requires the victim to actively open a malicious file, and yields only information disclosure with no modification or denial-of-service capability. EPSS at 0.46% (37th percentile) places this firmly in the low-probability exploitation tier. SSVC corroborates: exploitation status is 'none', the attack is not automatable (ruling out mass campaigns or worm propagation), and technical impact is only partial. The CVE is not listed in the CISA KEV catalog. The High confidentiality rating reflects genuine memory-leak severity but must be weighted against the mandatory user-interaction gate and local-only vector - this is not remotely triggerable. Priority should be standard patch-cycle remediation rather than emergency response. No conflicting signals exist between CVSS, EPSS, and SSVC; all three converge on a low-urgency, monitor-and-patch posture.

An attacker crafts a malicious Excel workbook embedding a synthetic pointer value within a parsed spreadsheet structure, then delivers it to a target via phishing email or a compromised shared drive. The victim opens the file in an unpatched Excel installation; Excel dereferences the attacker-supplied pointer during file parsing and leaks a region of process memory - potentially exposing in-process credentials, authentication tokens, or adjacent document content. No public exploit code exists at time of analysis, and the local interaction requirement means exploitation cannot be automated at scale.