What is the CVSS score of CVE-2026-55041?

CVE-2026-55041 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Excel are affected by CVE-2026-55041?

A local code execution vulnerability in Microsoft Excel and the broader Office suite (Microsoft 365 Apps, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) exposes all users who…. A patch is available.

How to fix or mitigate CVE-2026-55041?

Within 24 hours, inventory which Microsoft Office versions (365, 2019, 2021, 2024 LTSC, Mac) are deployed across the organization and identify affected users; issue a security advisory instructing users to avoid opening spreadsheets from untrusted sources and report suspicious files. Within 7 days, deploy the vendor-released patch from Microsoft's MSRC advisory for CVE-2026-55041 to all affected Office installations and confirm patch application. Within 30 days, complete patch deployment verification across all endpoints, enable email gateway controls to block potentially malicious Office attachments, and review security logs for any exploitation attempts prior to patching.

Microsoft Excel CVE-2026-55041

EUVD-2026-44186 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-14 microsoft

GHSA-7w65-7pmj-m7w2

Buffer Overflow Heap Overflow Microsoft Office Online Server Microsoft 365 Apps For Enterprise Microsoft Office Ltsc 2024 Microsoft Excel 2016 Microsoft Office 2019 Microsoft Office Ltsc 2021 Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Microsoft Office 365 For Mac

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-open vector (AV:L, UI:R) with no privileges needed (PR:N); memory-corruption code execution yields full C:H/I:H/A:H in the user's context, matching the vendor score.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:26 vuln.today

CVE Published

Jul 14, 2026 - 17:08 cve.org

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Excel (and the broader Office family including Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Office for Mac, and Office Online Server) stems from a heap-based buffer overflow that triggers when a user opens a maliciously crafted spreadsheet. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates an unauthenticated attacker gains full code execution in the victim's context but only after the target opens the file. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available from Microsoft (MSRC CVE-2026-55041).

Technical ContextAI

The root cause is CWE-122 (Heap-Based Buffer Overflow): Excel's file-parsing code writes past the bounds of a heap-allocated buffer while processing a crafted spreadsheet structure, corrupting adjacent heap metadata or objects. Excel parses many complex binary and XML-based formats (XLS/XLSX/XLSB) whose length fields and record structures must be validated against allocation sizes; a missing or incorrect bounds check lets attacker-controlled data overwrite the heap, which can be groomed into control-flow hijack and arbitrary code execution. The CPE set confirms this affects the shared Office rendering/parsing engine across Windows (Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024), macOS (Office 365 for Mac, Office LTSC for Mac 2021/2024), and server-side rendering via Office Online Server.

RemediationAI

Apply the Microsoft security update referenced in MSRC advisory CVE-2026-55041 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55041) - Patch available per vendor advisory; the exact fixed build numbers are published per channel in that advisory and should be pulled directly from it rather than assumed. For managed fleets, deploy via Microsoft Update / Click-to-Run channel updates for Microsoft 365 Apps and the corresponding LTSC/Mac update packages, and patch Office Online Server separately since it renders documents server-side. Until patched, reduce exposure by enabling Protected View and Block Macros / Mark-of-the-Web enforcement so untrusted spreadsheets open in a sandboxed, read-only mode (trade-off: users must click 'Enable Editing', causing minor friction), and use attachment filtering or Safe Attachments to detonate or strip inbound Excel files (trade-off: added mail-flow latency and possible false positives on legitimate spreadsheets). Because exploitation requires opening a file, user-awareness controls against opening untrusted spreadsheets provide additional defense.