What is the CVSS score of CVE-2026-55039?

CVE-2026-55039 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Microsoft Excel CVE-2026-55039

Q: Which versions of Microsoft Excel are affected by CVE-2026-55039?

Microsoft Excel and Office products (Excel, Microsoft 365 Apps, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) are vulnerable to local code execution attacks (CVE-2026-55039,…. A patch is available.

Q: How to fix or mitigate CVE-2026-55039?

Within 24 hours: Identify all systems running Microsoft Excel and Office products in your environment and assess which users routinely access externally-sourced or untrusted spreadsheets. Within 7 days: Deploy Microsoft's released security patch across all affected Office installations (Microsoft 365 Apps, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) prioritizing systems handling external documents. Within 30 days: Complete patching across the entire enterprise, verify patch installation compliance via your endpoint management tools, and reinforce user security awareness regarding the risks of opening files from untrusted sources.

EUVD-2026-44180 HIGH

Integer Underflow (CWE-191)

2026-07-14 microsoft

GHSA-h63h-p87q-mppp

Authentication Bypass Integer Overflow Microsoft Office Online Server Microsoft 365 Apps For Enterprise Microsoft Office Ltsc 2024 Microsoft Excel 2016 Microsoft Office 2019 Microsoft Office Ltsc 2021 Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Microsoft Office 365 For Mac

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File must be opened locally by the user (AV:L, UI:R) with no attacker privileges (PR:N); memory-corruption RCE in user context yields full C/I/A impact, scope unchanged.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:27 vuln.today

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 7.8

DescriptionCVE.org

Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Excel (and the broader Office suite through Microsoft 365 Apps, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) arises from an integer underflow (CWE-191) in Excel's file parsing, letting an attacker run arbitrary code in the context of the user who opens a maliciously crafted spreadsheet. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) shows no attacker privileges are needed but the victim must open the file, giving full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.

Technical ContextAI

The flaw is an integer underflow / wraparound (CWE-191) in the code that parses Excel workbook data. When a length, size, or offset field in a crafted spreadsheet is manipulated so a subtractive computation drops below zero, the value wraps to a very large unsigned number, corrupting subsequent memory allocation or bounds logic and enabling out-of-bounds access that can be steered toward arbitrary code execution. The CPE data confirms the affected code is shared across the entire Office family: Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Office 2019, Office LTSC 2021/2024, Office 365/LTSC for Mac (2021/2024), and Office Online Server - indicating the vulnerable parser is part of the common Office document-handling stack rather than a single build.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update for Office referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55039; the input does not list exact patched build numbers, so consult that advisory for the specific version per channel (Click-to-Run/Current, Monthly Enterprise, LTSC MSI, and Mac builds), and update Office Online Server on the server side. As compensating controls until patching completes, open untrusted spreadsheets in Protected View and keep macro and external-content settings locked down (this adds a click/friction cost for legitimate documents), block or quarantine inbound .xls/.xlsx/.xlsb attachments from untrusted senders at the mail gateway (trade-off: may delay legitimate business files), and use Attack Surface Reduction rules and warn-on-open policies to reduce the chance of a user directly opening a weaponized workbook. Because exploitation requires the user to open a file, user awareness training against unexpected spreadsheet attachments is a meaningful supplementary control.