Microsoft Excel CVE-2026-55029

Exploitation requires a user to open or preview a specially crafted Excel workbook delivered by the attacker - the CVSS vector's UI:R makes victim interaction a hard prerequisite, and AV:L means the malicious file must be processed locally by the target's Excel install rather than exploited over the network. No authentication into the application is needed (PR:N), so any user who can be socially engineered into opening a file is a valid target, but Protected View, macro/content blocking, or Mark-of-the-Web restrictions on internet-sourced files materially limit real-world exploitation. Code executes only in the opening user's security context (S:U), so a low-privilege victim yields low-privilege compromise absent a separate escalation.

This is a genuine but not top-tier emergency. The CVSS base score of 7.8 (High) reflects strong impact (C:H/I:H/A:H) but the AV:L and UI:R metrics mean an attacker cannot exploit it remotely without action - a user must open a malicious file, and code runs only with that user's privileges (no scope change, S:U). No EPSS score was provided in the input, and the CVE is not in CISA KEV, with no public exploit identified, so there is no evidence of active or automatable exploitation at this time. Balanced against that, Office file-format overflows are a historically favored vector for phishing and targeted intrusion, and a patch already exists, so this should be prioritized in normal patch cycles for endpoints handling untrusted spreadsheets. No SSVC decision data or EPSS figure was supplied, so automatability and exploitation-status signals beyond KEV are unavailable and should be confirmed before final triage.

An attacker emails a weaponized .xlsx spreadsheet crafted to overflow Excel's heap parser, using a lure that entices the target to open it and dismiss Protected View. When the file is opened, the overflow corrupts heap memory and executes attacker-controlled code with the victim's privileges, establishing a foothold for follow-on payloads. No public exploit is identified at this time, so this scenario is inferred from the CVSS local/user-interaction vector rather than an observed exploit.