Microsoft Excel CVE-2026-55031

Exploitation requires the victim to open an attacker-supplied, specially crafted Excel workbook on a vulnerable Office installation (UI:R in the CVSS vector) - there is no remote, unauthenticated, zero-click path. The attacker needs no privileges or credentials on the target (PR:N) and low attack complexity (AC:L), but the mandatory user-interaction gate is the key limiting factor: the malicious file must be delivered (typically via email or download) and the user must choose to open it, and for internet-sourced files they must also dismiss Protected View, which sandboxes the vulnerable parsing. Affected platforms include both Windows and macOS Office builds and, notably, Office Online Server where server-side file rendering could remove the interactive-user requirement. No special non-default configuration is otherwise required - standard Excel with file-open capability is sufficient.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) frames this as a local, low-complexity issue requiring no privileges but mandatory user interaction - the AV:L reflects that the malicious workbook must be opened on the target host rather than delivered over a network service, and UI:R is the primary limiting factor. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public exploit was identified, so the practical risk today is moderate rather than urgent: this is a client-side, phishing-dependent vulnerability typical of monthly Office updates, not a wormable network flaw. The combination of no confirmed active exploitation and a required user-interaction gate suggests this should be patched on a standard cadence rather than emergency-escalated, though the broad product footprint and full C/I/A impact keep it a genuine priority. Note a nuance: the tags emphasize 'Information Disclosure' while Microsoft's title states code execution - treat the high-impact code-execution framing as authoritative but verify the precise impact against the vendor advisory.

An attacker crafts a malicious Excel workbook with corrupted record-length or offset fields and emails it to a target as an invoice or report attachment. When the victim opens the file and the parser reads past the bounds of an allocated buffer, the attacker achieves code execution in the context of the user. No public proof-of-concept is currently available, and the attack depends on the victim opening the file and (if applicable) exiting Protected View.