Microsoft Excel CVE-2026-55044

Exploitation requires the victim to open a maliciously crafted Excel workbook - user interaction is mandatory (CVSS UI:R), and the vector is local (AV:L), meaning the attacker cannot trigger it remotely without delivering a file and having a user open it. No authentication or pre-existing privileges on the target are needed (PR:N), and default Excel configurations are affected across the listed Office editions. Limiting factors that reduce real-world exploitability: the requirement for social-engineering the user into opening the file, Protected View sandboxing for Mark-of-the-Web/internet-sourced files (which the user must actively bypass), and the absence of any public exploit code. Server-side exposure via Office Online Server depends on that component rendering an attacker-supplied spreadsheet.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local, low-complexity attack requiring no privileges but requiring user interaction - the classic 'open a malicious document' file-format bug. This is a real but not top-tier priority: it is not in CISA KEV, no EPSS score was provided, and no public exploit was identified, so there is no evidence of active exploitation or automatable mass exploitation. The realistic risk is targeted phishing/social-engineering delivery rather than wormable network compromise. One inconsistency to note: the Description calls this an 'out-of-bounds read' (CWE-125), which is typically an info-leak, yet the impact is stated as code execution with C:H/I:H/A:H and the tags include 'Buffer Overflow' - verify with the Microsoft advisory whether RCE is fully corroborated or whether the read primitive is one link in a larger chain. EPSS and SSVC data were not supplied and cannot be assessed.

An attacker emails a target a crafted Excel workbook (or hosts it on a shared drive or website) designed to trigger the out-of-bounds read in the parser. When the victim opens the file in a vulnerable Excel build, memory is read out of bounds and the corrupted state leads to code execution in the context of the user. No public proof-of-concept was identified, so this remains a plausible targeted-phishing scenario rather than a demonstrated exploit.