Microsoft Excel CVE-2026-55046

Exploitation requires a local user on the target system to actively open a specially crafted Excel workbook - the CVSS attack vector is local (AV:L) and user interaction is required (UI:R). The attacker needs no prior authentication or privileges on the target system (PR:N), but cannot remotely trigger parsing without the victim's deliberate action of opening the file. There is no special configuration, feature flag, or non-default setting required; any standard installation of an affected Excel version is vulnerable when a crafted file is opened. Impact is strictly confidentiality-only (C:H/I:N/A:N) - no code execution or file modification capability results from this flaw in isolation. The attack is not automatable (SSVC: Automatable: no), ruling out worm-style or mass-exploitation scenarios. For Office Online Server specifically, the user-interaction dependency may vary depending on whether the server automatically parses uploaded documents without explicit user action - defenders running OOS should assess their document processing pipeline independently.

The compound risk signal here is consistently low-to-moderate. CVSS 5.5 (Medium) reflects the local attack vector (AV:L), required user interaction (UI:R), no integrity or availability impact, and high confidentiality impact only - a narrow but real consequence profile. EPSS at 0.46% places this in the 37th percentile, meaning roughly 63% of CVEs are considered more likely to be exploited, reinforcing that opportunistic mass exploitation is not expected. SSVC corroborates this: Exploitation is rated 'none', the attack is not automatable, and technical impact is partial. There is no CISA KEV listing and no public POC has been identified at time of analysis. The C:H rating deserves attention in sensitive environments - process memory or document contents could be disclosed - but the attacker cannot remotely or autonomously trigger this; a targeted phishing or malicious document delivery campaign would be required. Office Online Server represents a slightly elevated concern if it processes untrusted documents server-side, as that could reduce the user-interaction dependency in practice - defenders should verify their OOS document ingestion workflows. Overall: patch in routine cycle; no emergency response warranted for most organizations.

An attacker crafts a malicious Excel workbook containing a specially structured spreadsheet record designed to trigger the out-of-bounds read in the file parser. The workbook is delivered to a target via a phishing email or a compromised file-sharing link, and when the victim opens the file in an unpatched version of Excel, the parser reads beyond the allocated buffer boundary and leaks adjacent memory contents - potentially including recently accessed document data or heap artifacts - which could be embedded in a secondary output channel or observed via file metadata. No public exploit code has been identified at time of analysis, and successful exploitation requires social engineering to induce the victim to open the file.