What is the CVSS score of CVE-2026-55036?

CVE-2026-55036 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Excel are affected by CVE-2026-55036?

CVE-2026-55036, a buffer over-read vulnerability in Microsoft Excel, enables remote code execution when users open maliciously crafted spreadsheets, affecting Microsoft 365 Apps, Office 2016/2019,…. A patch is available.

How to fix or mitigate CVE-2026-55036?

Within 24 hours: Audit your environment to identify all systems running Microsoft Office 2016, 2019, Microsoft 365 Apps, or Office LTSC 2021/2024 (both Windows and Mac), and advise users to avoid opening spreadsheets from untrusted sources pending remediation. Within 7 days: Deploy Microsoft's security update released via MSRC to all identified Office installations, prioritizing devices in roles that frequently receive or share external spreadsheet files. Within 30 days: Verify patch deployment across all endpoints using WSUS or your software management platform, validate that no suspicious spreadsheet file opens are detected in email and endpoint logs, and confirm file extension restrictions are enforced on email gateways for .xlsx and .xls files from external senders.

Microsoft Excel CVE-2026-55036

EUVD-2026-44194 HIGH

Buffer Over-read (CWE-126)

2026-07-14 microsoft

GHSA-mp23-5v8j-rg6j

Buffer Overflow Microsoft Office Online Server Microsoft 365 Apps For Enterprise Microsoft Office Ltsc 2024 Microsoft Excel 2016 Microsoft Office 2019 Microsoft Office Ltsc 2021 Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Microsoft Office 365 For Mac

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Document-open flaw: file delivered remotely but parsed locally (AV:L), no auth needed (PR:N) yet victim must open the file (UI:R), yielding full user-context compromise (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:29 vuln.today

CVE Published

Jul 14, 2026 - 17:08 cve.org

HIGH 7.8

DescriptionCVE.org

Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

AnalysisAI

Local arbitrary code execution in Microsoft Excel arises from a buffer over-read (CWE-126) triggered when a victim opens a maliciously crafted spreadsheet, letting an attacker run code in the context of the current user. The flaw spans Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024 (Windows and Mac) and Office Online Server; a vendor patch is available via MSRC. No public exploit has been identified at time of analysis, and the CVSS 7.8 (AV:L/UI:R) rating reflects that user interaction is required.

Technical ContextAI

The root cause is CWE-126 (Buffer Over-read), a memory-safety defect in which Excel's file parser reads past the intended bounds of an in-memory buffer while processing spreadsheet structures. Such out-of-bounds reads in Office parsers typically stem from trusting attacker-controlled length or offset fields in the binary/OOXML file format; the leaked or corrupted memory can be leveraged to influence control flow and achieve code execution. The CPE data identifies the affected code as the Excel/Office rendering engine shared across Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office 365 for Mac, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update for your Office channel referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55036; for click-to-run products (Microsoft 365 Apps, Office 365 for Mac) ensure automatic updates are enabled so the current channel build installs, and for MSI/LTSC 2016/2019/2021/2024 and Office Online Server deploy the corresponding monthly security update. Exact fixed build numbers should be taken from the MSRC update guide rather than assumed. Where patching is delayed, reduce exposure by enabling Protected View and Block Macros/Office file-block policies for spreadsheets originating from the internet or email (trade-off: users must explicitly enable editing, adding friction), and by using Attack Surface Reduction rules and mail-gateway filtering to strip or quarantine untrusted Excel attachments (trade-off: potential false positives on legitimate documents).