Microsoft Excel CVE-2026-55039

Exploitation requires the victim to open an attacker-supplied malicious Excel file (CVSS UI:R), and code runs only in the context and privilege level of that user - there is no remote or unauthenticated network trigger (AV:L). The limiting factors are: the attacker must deliver the crafted spreadsheet and convince the user to open it (and dismiss Protected View if enabled), the affected application must be an unpatched Office/Excel build from the listed CPEs, and gained privileges are bounded to the opening user rather than SYSTEM. No special product feature toggle is called out in the description beyond opening the file in Excel.

This is a moderately high but not emergency-tier risk. The CVSS base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects local attack vector requiring user interaction - the victim must open a malicious file - which caps real-world spread compared to a network-wormable bug, but the high triad impact means successful exploitation fully compromises the user context. No EPSS score, SSVC decision, KEV entry, or public POC was provided, so there is no evidence of active exploitation or automatable mass exploitation at this time; the primary delivery is social-engineering-driven (phishing with a weaponized spreadsheet). The 'Authentication Bypass' tag in the input appears inconsistent with the technical nature (memory-corruption RCE) and the CVSS vector, so treat that tag as unverified metadata rather than a confirmed second impact. Overall priority: patch promptly given ubiquity of Office, but absence of KEV/POC signals this is not yet under mass exploitation.

An attacker emails or shares a specially crafted Excel workbook that embeds malformed size/length fields; when the targeted user opens it in a vulnerable Office build, the integer underflow corrupts memory and executes attacker-supplied code with that user's privileges. No public exploit is identified at time of analysis, and the local vector with required user interaction means the attack hinges on successful social engineering rather than remote automation.