EUVD-2026-44160
GHSA-gmj3-jv2h-3mhj
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-borne exploitation is local (AV:L) and needs a user to open the workbook (UI:R) but no attacker privileges (PR:N); code execution yields full C/I/A in the user context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Excel (Office 2016 through LTSC 2024, Microsoft 365 Apps, and Mac editions) allows an attacker to run arbitrary code by tricking a user into opening a maliciously crafted spreadsheet that triggers a type-confusion condition in Excel's file parser. The CVSS 3.1 score is 7.8 (High) with the local vector reflecting file-open exploitation rather than remote-network access, and success requires user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The root cause is CWE-843 (Access of Resource Using Incompatible Type, or 'type confusion'), a memory-safety flaw in which Excel accesses an object or memory region as one type while it was allocated or interpreted as another. In Office file parsers this typically arises when handling structured spreadsheet content (records, embedded objects, or serialized structures) whose type tag is trusted without validation, letting an attacker supply data that is later dereferenced as an incompatible type - corrupting memory and yielding control-flow hijacking. The affected code is Excel's client-side document-processing engine, shared across the Windows Office family (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024), the macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024), and the server-side Office Online Server per the provided CPE list.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55024, using Microsoft Update / Click-to-Run for Microsoft 365 Apps and the Mac editions, and the corresponding monthly security update for Office 2016/2019 and Office LTSC 2021/2024; update Office Online Server separately as it patches independently. Exact fixed build numbers should be taken from the MSRC page since they are not provided in this dataset. Where immediate patching is not possible, reduce exposure by opening untrusted spreadsheets in Protected View and blocking Office files from executing content from the internet (Mark-of-the-Web enforcement), and consider Attack Surface Reduction rules that restrict Office child-process creation - the trade-off being that Protected View and ASR rules can disrupt legitimate macro-enabled or automated workflows and may generate user friction.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today