Microsoft Excel CVE-2026-54988

Exploitation requires a victim user to open or preview a specially crafted Excel spreadsheet file on a local system running an affected version of Microsoft Office. The CVSS vector AV:L/UI:R confirms both conditions: local file access is required (the file must be present on the system or a mounted share), and the user must actively open the file triggering the parser. PR:N indicates no elevated operating system privileges are needed - a standard user account opening a file is sufficient. Scope is unchanged (S:U), meaning the impact is confined to the Excel process and does not extend to other processes or system components. Exploitation is NOT possible over the network without user interaction, and SSVC automatable=no confirms no network-based automated exploitation path exists. Limiting factors beyond user interaction include: Protected View (if enabled) may interrupt the attack chain, and Office Online Server exposure depends on server-side rendering of uploaded files by authenticated users.

The CVSS 6.1 Medium score reflects a constrained threat model: AV:L and UI:R together mean the attacker must deliver a malicious file and the victim must open it, ruling out unauthenticated remote exploitation. EPSS at 0.31% (23rd percentile) is notably low, and CISA SSVC confirms exploitation=none and automatable=no, meaning no current active exploitation and no known mechanism for mass automated attack. These signals collectively indicate this is a real but low-urgency vulnerability. The most significant real-world impact is the A:H availability dimension - an attacker who can trick a user into opening a crafted spreadsheet can reliably crash Excel, which matters most in environments where Excel availability is operationally critical (e.g., financial workflows, automated reporting pipelines). The C:L confidentiality impact is bounded by S:U (unchanged scope), limiting any leaked memory to the Excel process context. There is no integrity impact (I:N). No conflicting signals between data sources: CVSS, EPSS, and SSVC all consistently indicate a moderate, non-automated, non-exploited risk. Real prioritization should favor organizations that routinely open externally sourced spreadsheets.

An attacker crafts a malicious Excel workbook file containing specially structured spreadsheet data designed to cause Excel's parser to read beyond an allocated memory buffer, then delivers it to a target user via phishing email or a compromised file share. When the victim opens the file on an unpatched Excel installation, the out-of-bounds read either crashes Excel entirely - disrupting the user's workflow - or leaks a small amount of adjacent process memory that could inform further exploitation. No public exploit code is known at time of analysis, making opportunistic mass targeting unlikely in the near term.