Microsoft Excel CVE-2026-55036

Exploitation requires a user to open or preview an attacker-crafted Excel document with a vulnerable Office/Excel build (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024 Windows or Mac, or Office Online Server) - the UI:R metric confirms victim interaction is mandatory, which is the primary limiting factor. No prior authentication or elevated privileges on the target are needed (PR:N), and attack complexity is low (AC:L), but the vulnerable code runs locally (AV:L) so the malicious file must first be delivered and opened. Protected View, macro/file-block policies, or mail filtering that prevents the file from being opened in an editable state will block or hinder the attack.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity, unauthenticated-but-user-interaction-dependent flaw with high impact to confidentiality, integrity and availability - the classic 'open a malicious document' profile rather than a remotely wormable bug. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input; the absence of KEV means there is no confirmed active exploitation. The AV:L designation is standard for document-open attacks (the file is delivered remotely but the vulnerable code executes locally), and the UI:R requirement materially lowers real-world risk versus a zero-click bug. Given the enormous install base of Office/Excel, this warrants prompt patching despite the lack of public exploit signals.

An attacker emails or hosts a crafted .xlsx/.xls file and lures a user into opening it; when Excel parses the malformed structure, the buffer over-read is triggered and attacker-controlled code executes with the victim's privileges. Because the CVSS vector requires user interaction (UI:R) and local execution (AV:L), the attack hinges on social engineering rather than an unattended network exploit. No public proof-of-concept has been identified at time of analysis.