Microsoft Excel CVE-2026-50675

Exploitation requires the victim to open a maliciously crafted Excel document - the CVSS vector explicitly includes UI:R (user interaction required) and AV:L (local), so this is not remotely triggerable without user action. No prior authentication or privileges on the target are needed (PR:N): any user who opens the file is sufficient. Limiting factors that reduce real-world risk: the mandatory file-open user interaction, execution confined to the opening user's privilege level (S:U, no privilege escalation implied), and Office Protected View / Mark-of-the-Web sandboxing which can block or sandbox internet-sourced files before the vulnerable parsing path is reached. Affected deployments span both Windows and macOS Office builds plus Office Online Server.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) indicates a local attack vector with low complexity, no required privileges, but mandatory user interaction - consistent with a file-open exploitation model rather than a remotely triggerable network flaw. The C:H/I:H/A:H impact yields a 7.8 base score. No EPSS score, POC, or SSVC decision data was provided, and the CVE is not in CISA KEV, so there is no evidence of active exploitation or automatable mass exploitation at this time; risk is therefore driven by the widespread deployment of Office rather than by any confirmed in-the-wild activity. One nuance to verify: PR:N means no authentication is required, but exploitation still hinges on social engineering the victim into opening a crafted file, which materially lowers real-world likelihood versus a zero-click bug. Given Microsoft has already shipped a patch and the product is ubiquitous in enterprises, this warrants prompt patching as part of routine Patch Tuesday hygiene, but is not an emergency-out-of-band-level threat on current signals.

An attacker emails a target a crafted .xlsx/.xls file (or hosts it on a shared drive or SharePoint), relying on low-complexity social engineering to get the user to open it. On open, Excel's parser overflows a heap buffer and the crafted content redirects execution, running attacker code with the victim's privileges. No public exploit code has been identified at time of analysis, but the local-vector, low-complexity profile makes weaponization plausible if details are reverse-engineered from the patch.