EUVD-2026-44037
GHSA-p2vq-f9rc-v3c2
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user (AV:L, UI:R) with no prior privileges (PR:N); memory-corruption code execution yields full C:H/I:H/A:H in the user's context (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Excel (including Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted spreadsheet, letting an attacker run arbitrary code in the user's context. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting that exploitation needs user interaction but no prior privileges once the file is opened. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a patch.
Technical ContextAI
The flaw is a heap-based buffer overflow (CWE-122), where Excel's file-parsing code writes past the bounds of a heap-allocated buffer while processing spreadsheet content. This occurs in the Office/Excel document parsing engine shared across Windows and Mac builds. Per the CPE data, affected code ships in cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_excel_2016, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024, and office_online_server. Corrupting adjacent heap metadata or objects can be leveraged to hijack control flow and achieve code execution in the process context of the user opening the file.
RemediationAI
Apply the Microsoft-released security update for your Office channel as the primary fix - patch is available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50675; the exact fixed build number is not enumerated in the provided data, so pull the version corresponding to your specific product (Microsoft 365 Apps, Office 2016/2019, LTSC 2021/2024, Office for Mac, or Office Online Server) from that MSRC page. Where immediate patching is not possible, reduce exposure by opening untrusted spreadsheets in Protected View and blocking files that originate from the internet via Mark-of-the-Web, and by configuring Office Trust Center to disable content from untrusted sources - trade-off is reduced convenience for users who legitimately edit externally sourced workbooks. For Office Online Server, restrict which document sources are rendered. As a general hardening measure, use attack surface reduction rules to limit Office child-process creation, accepting that some legitimate automation macros may break.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today