EUVD-2026-44177
GHSA-f28p-7rm3-827g
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a victim (AV:L, UI:R) with no prior auth (PR:N); memory-corruption code execution yields full C/I/A impact in the user context (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Arbitrary code execution in Microsoft Excel (across Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) arises from a heap-based buffer overflow (CWE-122) that triggers when a victim opens a maliciously crafted spreadsheet. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a local, user-interaction-dependent file-format attack rather than a remote network exploit, yielding code execution in the context of the current user. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV; a Microsoft patch is available.
Technical ContextAI
The vulnerability is a heap-based buffer overflow (CWE-122) in Excel's spreadsheet parsing engine, the code path that deserializes workbook file formats (e.g., XLSX/XLS/binary BIFF structures). A heap overflow occurs when Excel writes more data into a dynamically allocated buffer than it was sized for, corrupting adjacent heap metadata or object pointers, which an attacker can groom to hijack control flow. The CPE data shows the flaw spans the shared Office code base rather than a single edition: Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office 365/LTSC for Mac 2021 and 2024, Office LTSC 2021 and 2024, and Office Online Server are all affected, indicating the vulnerable parsing component is common to both Windows and macOS Office builds and to server-side rendering via Office Online Server.
RemediationAI
Apply the Microsoft security update for CVE-2026-55029 as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55029 (Patch available per vendor advisory); for click-to-run installs of Microsoft 365 Apps and Office LTSC this arrives via the normal update channel, while Office Online Server and MSI-based Office 2016/2019 require the corresponding cumulative/security package for the affected build. Until patching completes, reduce exposure by enforcing Protected View and blocking macros/content from files originating on the internet, and by restricting or gateway-scanning inbound spreadsheet attachments; note that aggressive Protected View or attachment blocking can impede legitimate business workflows, so scope it to untrusted sources. For Office Online Server, restrict the rendering service to trusted document repositories to avoid processing attacker-supplied workbooks.
More in Office Online Server
View allMicrosoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011,
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 201
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Comp
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word f
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 201
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today