EUVD-2026-44195
GHSA-4mg3-vgrx-mf99
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local crafted-file vector needing the user to open the document (AV:L/UI:R), no privileges required (PR:N), and vendor-stated code execution yields high C/I/A.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Excel (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) arises from an out-of-bounds read (CWE-125) triggered when a victim opens a maliciously crafted spreadsheet. CVSS 7.8 with high impact to confidentiality, integrity, and availability; no public exploit identified at time of analysis. Exploitation requires user interaction (opening the file) but no prior authentication or privileges on the target beyond the ability to induce the user to open the document.
Technical ContextAI
The flaw is an out-of-bounds read (CWE-125) in the Excel file-parsing code path, which handles the deserialization of spreadsheet structures (OOXML/legacy BIFF binary formats). An out-of-bounds read means the parser accesses memory beyond the intended buffer boundary while interpreting attacker-controlled fields - length values, offsets, or record counts inside a crafted workbook. While CWE-125 is classically an information-disclosure primitive, Microsoft and the accompanying tags ('Buffer Overflow', 'Information Disclosure') indicate that the memory-safety violation is leveraged for code execution, most likely by corrupting adjacent program state or leaking data used to defeat memory protections. The CPE set confirms the affected surface is the Excel component shared across Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the macOS builds (Office 365 for Mac, Office LTSC for Mac 2021/2024), and the server-side Office Online Server.
RemediationAI
Patch available per vendor advisory - apply the Microsoft update for CVE-2026-55044 across all affected Office channels (Microsoft 365 Apps via Click-to-Run automatic updates, and the corresponding security update for Excel 2016, Office 2019, Office LTSC 2021/2024, the Mac builds, and Office Online Server) as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55044; the input does not enumerate exact fixed build numbers, so retrieve them from that advisory rather than assuming. Because exploitation requires the user to open a crafted file, effective compensating controls until patching completes include: enabling Protected View / Application Guard for files originating from the internet or email (trade-off: users must click to exit Protected View for legitimate untrusted files), blocking or quarantining spreadsheet attachments (.xls/.xlsx/.xlsm) at the mail gateway, and enabling Attack Surface Reduction rules and Mark-of-the-Web enforcement. User-awareness guidance to not open unexpected spreadsheets reduces but does not eliminate risk.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today