Microsoft Excel CVE-2026-55041

Exploitation requires the victim to open an attacker-supplied, maliciously crafted Excel/Office document in a vulnerable build (UI:R in the CVSS vector), and the attacker needs no prior authentication or privileges on the target (PR:N). The attack vector is local (AV:L) - the malicious file must reach and be opened on the target host (via email, download, or file share); there is no network-triggerable path. Exploitation is limited by the need for user interaction (the target must open the file and, where Protected View/Mark-of-the-Web applies, choose to enable editing), by the requirement that a vulnerable, unpatched Office/Excel build is in use, and by the standard C-to-Z heap-grooming reliability challenges inherent to CWE-122 corruption.

The CVSS 3.1 base score is 7.8 (High) with AV:L (local), AC:L (low complexity), PR:N (no privileges), UI:R (user interaction required), and full C:H/I:H/A:H impact - the classic 'open a weaponized document' profile. No EPSS score, SSVC decision, KEV entry, or POC was provided, so real-world exploitation pressure is unconfirmed: there is no public exploit identified at time of analysis and no evidence of active exploitation. The dependency on user interaction (UI:R) and local vector (AV:L) meaningfully limits mass exploitation, making this best suited to targeted phishing/social-engineering campaigns rather than wormable, unauthenticated remote attacks. Given the enormous install base of Office, however, the aggregate exposure is large and patching should be prioritized on the standard monthly cadence even absent a POC. Note: EPSS and KEV data are absent from the input - verify current EPSS/KEV status before final triage.

An attacker emails or hosts a specially crafted Excel spreadsheet and lures a victim into opening it (e.g., a spearphishing message with a business-themed attachment). Because AC:L and UI:R apply, opening the file with a vulnerable Office build triggers the heap overflow and runs attacker code in the user's security context with no elevation required. No public exploit is identified at time of analysis, so this scenario is theoretical pending a working POC.