What is the CVSS score of CVE-2026-55024?

CVE-2026-55024 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-55024?

Within 24 hours, create an inventory of all deployed Microsoft Excel versions (Office 2016, Office 2019, Office 2021, LTSC 2024, and Microsoft 365 Apps for Windows and Mac editions) and identify systems not yet patched. Within 7 days, deploy vendor patches to all affected installations via your standard update mechanism (Windows Update, Office 365 channels, or manual updates for LTSC), prioritizing business-critical systems and executives. By 30 days, complete a full remediation audit to confirm all Excel installations are patched, conduct functional testing on a representative sample of patched systems, and document completion in your vulnerability tracking system.

Microsoft Excel CVE-2026-55024

Q: Which versions of Microsoft Excel are affected by CVE-2026-55024?

Microsoft Excel across widely-deployed versions (2016 through LTSC 2024 and Microsoft 365 Apps) contains a local code execution vulnerability that allows attackers to compromise user systems through…. A patch is available.

EUVD-2026-44160 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-14 microsoft

GHSA-gmj3-jv2h-3mhj

Authentication Bypass Memory Corruption Microsoft Office Online Server Microsoft 365 Apps For Enterprise Microsoft Office Ltsc 2024 Microsoft Excel 2016 Microsoft Office 2019 Microsoft Office Ltsc 2021 Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Microsoft Office 365 For Mac

7.8

CVSS 3.1 · Vendor: microsoft

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious Excel workbook
Delivery

Deliver via email or web download
Exploit

User opens file in Excel
Execution

Trigger type confusion in parser
Persist

Corrupt memory and hijack control flow
Impact

Execute code as current user

Vulnerability Assessment

Weakness	CWE CWE-843 ASVS 5.0 V15 - Secure Coding and Architecture Type safety enforcement MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to open or preview an attacker-crafted Excel file on an affected Office installation - the CVSS UI:R and AV:L metrics confirm mandatory user interaction and local file handling as prerequisites. No authentication is needed by the attacker (PR:N), and no special Office configuration is called out in the description, so default installations are affected; the primary limiting factors are that a user must be induced to open the malicious document and that Protected View / Mark-of-the-Web can block or sandbox files arriving from the internet, blunting the most common delivery paths.
Impact	The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8) describes local access with low complexity, no privileges, but mandatory user interaction and full confidentiality/integrity/availability impact within the victim's user context. The AV:L designation is normal for document-borne Office bugs: the malicious file must reach and be opened on the endpoint, so 'local' does not weaken severity but does mean it is not wormable over the network. No EPSS score, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input - this is a real but not confirmed-exploited priority, warranting standard patch-cycle urgency for a code-execution client bug. Note a data conflict: the auto-generated Tags include 'Authentication Bypass,' which is inconsistent with a type-confusion local code-execution flaw and with the CWE-843/CVSS impact; treat that tag as likely spurious and rely on the CWE and CVSS instead.
Exploit ScenarioDerived	An attacker emails a target a crafted Excel workbook (or hosts it on a file share or website) and uses social engineering to get it opened; when Excel parses the malformed structure, the type-confusion flaw corrupts memory and executes attacker-supplied code in the context of the logged-in user. No public exploit was identified at time of analysis, so this reflects the CVSS-implied path (AV:L/AC:L/UI:R) rather than an observed campaign.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Local code execution in Microsoft Excel (Office 2016 through LTSC 2024, Microsoft 365 Apps, and Mac editions) allows an attacker to run arbitrary code by tricking a user into opening a maliciously crafted spreadsheet that triggers a type-confusion condition in Excel's file parser. The CVSS 3.1 score is 7.8 (High) with the local vector reflecting file-open exploitation rather than remote-network access, and success requires user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55024, using Microsoft Update / Click-to-Run for Microsoft 365 Apps and the Mac editions, and the corresponding monthly security update for Office 2016/2019 and Office LTSC 2021/2024; update Office Online Server separately as it patches independently. Exact fixed build numbers should be taken from the MSRC page since they are not provided in this dataset. Where immediate patching is not possible, reduce exposure by opening untrusted spreadsheets in Protected View and blocking Office files from executing content from the internet (Mark-of-the-Web enforcement), and consider Attack Surface Reduction rules that restrict Office child-process creation - the trade-off being that Protected View and ASR rules can disrupt legitimate macro-enabled or automated workflows and may generate user friction.

Affected VersionsENISA

Office Online Server 16.0.0.0 <16.0.10417.20175

Microsoft Office LTSC 2021 16.0.1 <https://aka.ms/OfficeSecurityReleases

Microsoft 365 Apps for Enterprise 16.0.1 <https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2024 16.0.0 <https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC for Mac 2024 16.0.0 <16.111.26071215

Microsoft Office 365 for Mac 1.0.0 <16.111.26071215

Microsoft Office LTSC for Mac 2021 16.0.1 <16.111.26071215

Microsoft Office 2019 19.0.0 <https://aka.ms/OfficeSecurityReleases

Microsoft Excel 2016 16.0.0.0 <16.0.5561.1001

Affected Packages

euvd microsoft_excel_2016 fix: 16.0.5561.1001

euvd microsoft_office_365_for_mac fix: 16.111.26071215

euvd microsoft_office_ltsc_for_mac_2021 fix: 16.111.26071215

euvd microsoft_office_ltsc_for_mac_2024 fix: 16.111.26071215

euvd office_online_server fix: 16.0.10417.20175

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is CWE-843 (Access of Resource Using Incompatible Type, or 'type confusion'), a memory-safety flaw in which Excel accesses an object or memory region as one type while it was allocated or interpreted as another. In Office file parsers this typically arises when handling structured spreadsheet content (records, embedded objects, or serialized structures) whose type tag is trusted without validation, letting an attacker supply data that is later dereferenced as an incompatible type - corrupting memory and yielding control-flow hijacking. The affected code is Excel's client-side document-processing engine, shared across the Windows Office family (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024), the macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024), and the server-side Office Online Server per the provided CPE list.

Know when Office Online Server gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

File-borne exploitation is local (AV:L) and needs a user to open the workbook (UI:R) but no attacker privileges (PR:N); code execution yields full C/I/A in the user context.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Executive ViewAI

Why It Matters

Microsoft Excel across widely-deployed versions (2016 through LTSC 2024 and Microsoft 365 Apps) contains a local code execution vulnerability that allows attackers to compromise user systems through maliciously-crafted spreadsheets. With no public exploit identified at time of analysis, the vulnerability still threatens all employees with Excel access and requires only social engineering to exploit. Immediate patch deployment is essential to prevent future exploitation.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.4%

Top 68% exploitable

Prevalence

Ubiquitous

Microsoft Excel/Office is deployed across a huge fraction of enterprise and consumer endpoints

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.