What is the CVSS score of CVE-2026-55037?

CVE-2026-55037 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Office Online Server CVE-2026-55037

Q: Which versions of Office Online Server are affected by CVE-2026-55037?

All Microsoft Excel installations across the organization-including Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server-contain a critical flaw…. A patch is available.

Q: How to fix or mitigate CVE-2026-55037?

Within 24 hours, send urgent communications to all users instructing them to exercise caution with unexpected spreadsheet attachments, and ensure Office macro security settings are configured to block macros by default. Within 7 days, begin deploying the patch available per vendor advisory, prioritizing Microsoft 365 Apps and Office LTSC 2021/2024 installations to business-critical teams; simultaneously verify Office Online Server instances have been updated. Within 30 days, complete patch deployment across all Office 2016 and 2019 installations as well as all Office for Mac deployments through your standard update mechanism, and conduct log reviews to identify any potentially compromised systems from recently opened spreadsheet files.

EUVD-2026-44198 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-14 microsoft

GHSA-9vr8-vg7r-fgf5

Buffer Overflow Heap Overflow Microsoft Office Online Server Microsoft 365 Apps For Enterprise Microsoft Office Ltsc 2024 Microsoft Excel 2016 Microsoft Office 2019 Microsoft Office Ltsc 2021 Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Microsoft Office 365 For Mac

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

View

Vulnerability Assessment

Weakness

CWE

CWE-122

ASVS 5.0

V15 - Secure Coding and Architecture Heap buffer bounds checking

MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Arbitrary code execution in Microsoft Excel (spanning Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) allows an unauthorized attacker to run code in the victim's context by tricking them into opening a maliciously crafted spreadsheet. The flaw is a heap-based buffer overflow (CWE-122) that executes with the local user's privileges once the file is opened. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Affected VersionsENISA

Microsoft Office LTSC 2021 16.0.1 <https://aka.ms/OfficeSecurityReleases

Microsoft Excel 2016 16.0.0.0 <16.0.5561.1001

Microsoft Office LTSC for Mac 2024 16.0.0 <16.111.26071215

Microsoft Office 2019 19.0.0 <https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC for Mac 2021 16.0.1 <16.111.26071215

Microsoft 365 Apps for Enterprise 16.0.1 <https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2024 16.0.0 <https://aka.ms/OfficeSecurityReleases

Microsoft Office 365 for Mac 1.0.0 <16.111.26071215

Office Online Server 16.0.0.0 <16.0.10417.20175

Affected Packages

microsoft 365_apps_for_enterprise_https_aka_ms_officesecurityreleases fix: Microsoft 365 Apps for Enterprise for 32-bit Systems https://aka.ms/OfficeSecurityReleases, Microsoft 365 Apps for Enterprise for 64-bit Systems https://aka.ms/OfficeSecurityReleases

microsoft excel_2016_32_bit_edition_16_0_5561_1001 fix: Microsoft Excel 2016 (32-bit edition) 16.0.5561.1001

microsoft excel_2016_64_bit_edition_16_0_5561_1001 fix: Microsoft Excel 2016 (64-bit edition) 16.0.5561.1001

microsoft office_2019_editions_https_aka_ms_officesecurityreleases fix: Microsoft Office 2019 for 32-bit editions https://aka.ms/OfficeSecurityReleases, Microsoft Office 2019 for 64-bit editions https://aka.ms/OfficeSecurityReleases

microsoft office_365_for_mac_16_111_26071215 fix: Microsoft Office 365 for Mac 16.111.26071215

microsoft office_ltsc_2021_editions_https_aka_ms_officesecurityreleases fix: Microsoft Office LTSC 2021 for 32-bit editions https://aka.ms/OfficeSecurityReleases, Microsoft Office LTSC 2021 for 64-bit editions https://aka.ms/OfficeSecurityReleases

microsoft office_ltsc_2024_editions_https_aka_ms_officesecurityreleases fix: Microsoft Office LTSC 2024 for 32-bit editions https://aka.ms/OfficeSecurityReleases, Microsoft Office LTSC 2024 for 64-bit editions https://aka.ms/OfficeSecurityReleases

microsoft office_ltsc_for_mac_2021_16_111_26071215 fix: Microsoft Office LTSC for Mac 2021 16.111.26071215

microsoft office_ltsc_for_mac_2024_16_111_26071215 fix: Microsoft Office LTSC for Mac 2024 16.111.26071215

microsoft office_online_server_16_0_10417_20175 fix: Office Online Server 16.0.10417.20175

euvd microsoft_excel_2016 fix: 16.0.5561.1001

euvd microsoft_office_365_for_mac fix: 16.111.26071215

euvd microsoft_office_ltsc_for_mac_2021 fix: 16.111.26071215

euvd microsoft_office_ltsc_for_mac_2024 fix: 16.111.26071215

euvd office_online_server fix: 16.0.10417.20175

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 15 packages in microsoft, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Office Online Server gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal) 6.8 MEDIUM

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Executive ViewAI

Why It Matters

All Microsoft Excel installations across the organization-including Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server-contain a critical flaw enabling arbitrary code execution when users open malicious spreadsheets. Though no public exploit code has been identified, the widespread use of Excel and the nature of the vulnerability create severe organizational risk if attackers develop or discover exploitation techniques.

Recommended Action

Within 24 hours, send urgent communications to all users instructing them to exercise caution with unexpected spreadsheet attachments, and ensure Office macro security settings are configured to block macros by default. Within 7 days, begin deploying the patch available per vendor advisory, prioritizing Microsoft 365 Apps and Office LTSC 2021/2024 installations to business-critical teams; simultaneously verify Office Online Server instances have been updated. Within 30 days, complete patch deployment across all Office 2016 and 2019 installations as well as all Office for Mac deployments through your standard update mechanism, and conduct log reviews to identify any potentially compromised systems from recently opened spreadsheet files.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.3%

Top 77% exploitable

Vendor Action

See Below

Required. The vulnerability documented by this CVE requires customer action to resolve.

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.