Microsoft Excel CVE-2026-55025

Exploitation requires the victim to open a specially crafted Excel workbook in a vulnerable Office build - the CVSS UI:R and AV:L metrics confirm required user interaction and local file processing rather than remote network delivery. No authentication is required of the attacker (PR:N), and no non-default Excel configuration is needed: default handling of workbook content is sufficient once the file is opened. Limiting factors that reduce realistic risk: the attacker must first deliver the file and socially engineer the user into opening it and, in practice, into leaving Protected View / bypassing Mark-of-the-Web warnings; code runs only with the opening user's privileges (S:U, no privilege escalation), so impact is bounded by that user's rights.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a locally-triggered flaw requiring user interaction (opening a file) but no authentication, with full high impact to confidentiality, integrity, and availability - characteristic of a client-side document exploit. No EPSS score, SSVC decision, or POC availability was provided in the input, so exploitation probability cannot be quantified. It is not in CISA KEV, so there is no confirmed active exploitation. The dependence on user interaction (UI:R) and local vector (AV:L, i.e. the victim must open the file) meaningfully limits mass exploitation compared to a remote unauthenticated bug, but Office file-based attacks are a proven, high-value phishing vector, so this should be treated as a real patch priority rather than a theoretical high-CVSS issue. Note the input Tags include 'Authentication Bypass,' which is inconsistent with a type-confusion RCE and the CVSS scope/impact - treat that tag as unreliable metadata, not a confirmed characteristic.

An attacker crafts a malicious .xlsx/.xls workbook that triggers the type-confusion condition and emails it to a target or hosts it on a shared drive or web link. When the victim opens the file in a vulnerable Excel build (and bypasses or lacks Protected View), the malformed object is processed with the wrong type, corrupting memory and executing attacker code in the user's security context. No public POC is identified in the provided data.