EUVD-2026-44194
GHSA-mp23-5v8j-rg6j
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Document-open flaw: file delivered remotely but parsed locally (AV:L), no auth needed (PR:N) yet victim must open the file (UI:R), yielding full user-context compromise (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local arbitrary code execution in Microsoft Excel arises from a buffer over-read (CWE-126) triggered when a victim opens a maliciously crafted spreadsheet, letting an attacker run code in the context of the current user. The flaw spans Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024 (Windows and Mac) and Office Online Server; a vendor patch is available via MSRC. No public exploit has been identified at time of analysis, and the CVSS 7.8 (AV:L/UI:R) rating reflects that user interaction is required.
Technical ContextAI
The root cause is CWE-126 (Buffer Over-read), a memory-safety defect in which Excel's file parser reads past the intended bounds of an in-memory buffer while processing spreadsheet structures. Such out-of-bounds reads in Office parsers typically stem from trusting attacker-controlled length or offset fields in the binary/OOXML file format; the leaked or corrupted memory can be leveraged to influence control flow and achieve code execution. The CPE data identifies the affected code as the Excel/Office rendering engine shared across Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office 365 for Mac, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for your Office channel referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55036; for click-to-run products (Microsoft 365 Apps, Office 365 for Mac) ensure automatic updates are enabled so the current channel build installs, and for MSI/LTSC 2016/2019/2021/2024 and Office Online Server deploy the corresponding monthly security update. Exact fixed build numbers should be taken from the MSRC update guide rather than assumed. Where patching is delayed, reduce exposure by enabling Protected View and Block Macros/Office file-block policies for spreadsheets originating from the internet or email (trade-off: users must explicitly enable editing, adding friction), and by using Attack Surface Reduction rules and mail-gateway filtering to strip or quarantine untrusted Excel attachments (trade-off: potential false positives on legitimate documents).
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today