EUVD-2026-44172
GHSA-88h5-prqr-v67r
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open vector (AV:L) with mandatory user interaction (UI:R), no privileges needed (PR:N), yielding full code-execution impact across C/I/A, consistent with an Office client parsing flaw.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Excel (spanning Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, the macOS builds, and Office Online Server) arises from an out-of-bounds read (CWE-125) that an attacker triggers by convincing a user to open a maliciously crafted workbook. The CVSS 3.1 base score is 7.8 with high confidentiality, integrity, and availability impact, but exploitation requires user interaction (opening the file) and no active exploitation or public proof-of-concept has been reported. There is no public exploit identified at time of analysis; Microsoft has released a patch via its Security Update Guide.
Technical ContextAI
The flaw is an out-of-bounds read (CWE-125) in the file-parsing logic of Microsoft Excel, the spreadsheet component of the Microsoft Office / Microsoft 365 suite. Out-of-bounds reads occur when code accesses memory beyond the bounds of an allocated buffer, typically because a length or index field embedded in a structured file format is trusted without validation; in Office file parsers this commonly involves the binary (BIFF/xls) or OOXML (xlsx) structures where record sizes or offsets are attacker-controlled. Although classified primarily as an information-disclosure/buffer-overflow class issue in the tags, Microsoft describes the outcome as code execution, indicating the memory-safety error is exploitable beyond mere data leakage. The CPE data confirms the affected surface spans desktop Windows builds (Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise), macOS builds (Office 365 for Mac, Office LTSC for Mac 2021/2024), and the server-side Office Online Server rendering component.
RemediationAI
Apply the Microsoft security update for CVE-2026-55031 as documented in the Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55031 - Patch available per vendor advisory; the exact fixed build numbers per product channel (Current Channel, Monthly Enterprise, LTSC, and Mac editions) should be pulled from that advisory and deployed via your normal Office/Microsoft 365 update mechanism (Click-to-Run, WSUS/Intune, or the Mac AutoUpdate tool). Until patches are deployed, reduce exposure by opening untrusted spreadsheets in Protected View (the default for files from the internet and email attachments) and ensuring Protected View is not disabled by policy, since it sandboxes the parsing that triggers the out-of-bounds read; the trade-off is reduced editing convenience for users who routinely handle external files. Additionally, enforce Office macro and file-block policies to quarantine spreadsheets from untrusted sources, and patch Office Online Server servers, which process uploaded files server-side and therefore cannot rely on client Protected View.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today