Skip to main content
View

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Arbitrary code execution in Microsoft Office Excel arises from a use-after-free (CWE-416) memory-corruption flaw affecting Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server. The CVSS 3.1 vector (AV:L/UI:R) makes this a user-interaction-dependent, locally-scoped issue: a victim must open a maliciously crafted Excel workbook, after which the attacker gains code execution in the user's security context. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.

Affected VersionsENISA

Microsoft Office LTSC for Mac 2024 16.0.0 <16.111.26071215
Microsoft Office LTSC for Mac 2021 16.0.1 <16.111.26071215
Microsoft Office LTSC 2021 16.0.1 <https://aka.ms/OfficeSecurityReleases
Microsoft Office 2019 19.0.0 <https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise 16.0.1 <https://aka.ms/OfficeSecurityReleases
Microsoft Office 365 for Mac 1.0.0 <16.111.26071215
Microsoft Office LTSC 2024 16.0.0 <https://aka.ms/OfficeSecurityReleases
Office Online Server 16.0.0.0 <16.0.10417.20175

Affected Packages

euvd microsoft_office_365_for_mac fix: 16.111.26071215
euvd microsoft_office_ltsc_for_mac_2021 fix: 16.111.26071215
euvd microsoft_office_ltsc_for_mac_2024 fix: 16.111.26071215
euvd office_online_server fix: 16.0.10417.20175

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Office Online Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Executive ViewAI

Why It Matters

A use-after-free memory corruption vulnerability in Microsoft Office Excel (CVE-2026-54131) enables arbitrary code execution when users open maliciously crafted workbooks. This affects Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021/2024, Mac, and Office Online Server. Organizations must prioritize patching to prevent attackers from gaining code execution in user security contexts across the enterprise.

Recommended Action

Within 24 hours: Identify all systems running affected Office versions (Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Office for Mac, Office Online Server) and communicate urgency to IT and users. Within 7 days: Deploy the vendor-released patch to all identified systems via your standard patch management process, prioritizing Office endpoints. Within 30 days: Verify patch deployment across 100% of affected systems; additionally, implement email attachment controls to block or quarantine Excel files from untrusted senders as a layered defense.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 77% exploitable
Vendor Status
Publicly Disclosed:No
Exploited:No
Latest Software Release:Exploitation Less Likely
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment MSRC VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Office Online Server

View all
CVE-2023-21716 CRITICAL POC
9.8 Feb 14

Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
CVE-2016-3282 HIGH
7.8 Jul 13

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,

CVE-2021-34501 HIGH
7.8 Jul 14

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
CVE-2017-0281 HIGH
7.8 May 12

Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
CVE-2017-8743 HIGH
7.8 Sep 13

A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,

CVE-2017-8501 HIGH
7.8 Jul 11

Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
CVE-2016-3358 HIGH
7.8 Sep 14

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
CVE-2016-0025 HIGH
7.3 Jun 16

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
CVE-2022-41106 HIGH
8.8 Nov 09

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
CVE-2017-8631 HIGH
7.8 Sep 13

A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
CVE-2025-27751 HIGH POC
7.8 Apr 08

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
CVE-2025-47165 HIGH POC
7.8 Jun 10

Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
PATCH https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54131 ADVISORY https://vuldb.com/vuln/378814

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy