EUVD-2026-44169
GHSA-wgfr-mf59-497p
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user (AV:L, UI:R) with no attacker auth (PR:N); type-confusion RCE runs as the user yielding full C/I/A impact without scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Excel (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Office Online Server) arises from a type-confusion flaw (CWE-843) in how Excel parses spreadsheet content. An attacker who convinces a victim to open a malicious workbook can run arbitrary code in the context of the current user, gaining high confidentiality, integrity, and availability impact. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The root cause is CWE-843 (Access of Resource Using Incompatible Type, 'type confusion'), a memory-safety class in which code accesses an object as one type while it was actually allocated or initialized as another, corrupting internal state and enabling attacker-controlled memory manipulation. The vulnerable component is Excel's spreadsheet parsing/deserialization logic within the Office file-handling stack. Per the CPE data, the flaw spans the shared Office codebase used by microsoft_365_apps_for_enterprise, microsoft_excel_2016, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024, and office_online_server - meaning both Windows and macOS builds and server-side rendering are affected. Type confusion in a document parser typically yields a controllable read/write primitive that can be chained to code execution.
RemediationAI
Patch available per vendor advisory: apply the Microsoft update for CVE-2026-55025 documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55025, selecting the fixed build for each affected SKU (Microsoft 365 Apps via Click-to-Run auto-update, the corresponding security update for Office 2019/LTSC 2021/2024, the macOS Office updates, and the Office Online Server package). Exact fix version numbers are not included in the input data and should be taken directly from the MSRC advisory. Until patched, reduce exposure by enabling Protected View and blocking macros/content from untrusted sources, opening untrusted Excel files only in Protected View or a sandbox, and using Office file-block / attack-surface-reduction policies to prevent opening documents from email and the internet - trade-offs being that aggressive file-blocking and Protected View can disrupt legitimate workflows that rely on external workbooks and macros. For Office Online Server, restrict document upload/rendering to trusted sources.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today